TalentSync privacy policy: how we handle candidate, client and visitor data

The short version

TalentSync is a Moldovan tech-recruitment company. We hold three kinds of personal data: website server logs, business contacts at client companies, and engineers’ professional profiles. We find engineers on public professional platforms, tell them so in our first message, and share profiles only with named clients you have agreed to.

• We keep candidate profiles no longer than 24 months from our last contact with you, and keep placement, invoicing and tax records for the longer periods the law requires — §10 lists every period we hold.
• We do not use automated decision-making or AI screening to evaluate candidates. Every shortlist is assembled by a person who has read your profile.
• This site sets no cookies at all, and we run no analytics. Nothing is stored on your device and nothing is read from it, so there is nothing to consent to and you will not be asked to answer a cookie banner. If that ever changes, we update this policy first and ask for your consent before anything is set.
• We never charge a candidate anything, for any reason.

Where this summary and §§4–17 differ, §§4–17 govern. Everything below is the detail.

1. Who we are and how to reach us

1.1 The controller

TalentSync is a trading name, not the registered entity. The controller is S.R.L. “UNQENERGY” (IDNO 1020600034949); “TalentSync”, “we”, “us” and “our” mean that company throughout this policy. “You” means whoever is reading — a website visitor, a client contact, or an engineer.

1.2 Our privacy contact

Day-to-day privacy questions, rights requests and complaints go to Victor Uncuta, our CEO, at victor@talentsync.eu.

We are not required to appoint a Data Protection Officer. Our core activities do not involve large-scale systematic monitoring, and we do not process special-category or criminal-conviction data at scale. We have deliberately appointed a named privacy contact instead of designating a formal DPO. If that ever changes we will publish the DPO’s details here and notify the Moldovan supervisory authority, as Article 37(7) of Law No. 195/2024 requires.

1.3 Representation in the European Union

We have not appointed a representative in the European Union under Article 27 GDPR. We are assessing whether our processing requires one. If it does, we will appoint a representative and publish their name, address and contact details in this section.

That assessment changes nothing about what you can do. Write to us directly at victor@talentsync.eu about anything in this policy — we answer within one month, free of charge, as §12 sets out — and you may complain to the data protection authority in your own country at any time, whether or not you have contacted us first (§17).

1.4 Our representative in the United Kingdom

We have not appointed a UK representative. Our UK contacts are corporate clients rather than individuals to whom we offer services, and we do not currently source candidates in the UK or operate any tracking technology that reaches UK visitors. If that changes we will appoint one and publish the details here. We revisit this the moment a UK client asks us for a UK-resident engineer.

2. Who this policy covers, and how to read it

Your rights, and our legal reasons for holding your data, are genuinely different depending on which of these you are. Read your own section — the rest will not apply to you.

Sections 8 to 17 apply to everyone.

One standard for everyone. Our candidates and clients sit in the EU, the UK, Moldova and Ukraine. Rather than run four compliance standards, we apply the strictest one — the EU GDPR — to everybody. If you are in Moldova or Ukraine, you get EU-level treatment as a matter of policy even where your own law asks for less.

3. Which laws apply to us

Two regimes apply to us simultaneously, and this policy is written to satisfy both.

Republic of Moldova — Law No. 195 of 25 July 2024 on personal data protection. In force since 23 August 2026, replacing Law No. 133/2011. It transposes the GDPR almost word for word: the principles, lawful bases, data-subject rights, transfer rules and accountability duties are the same articles with the same numbers. Our supervisory authority is the National Centre for Personal Data Protection (CNPDCP) in Chișinău.

European Union — Regulation (EU) 2016/679 (GDPR), via Article 3(2). The GDPR reaches us directly because we offer our services to people in the EU: we operate a .eu domain in English, quote prices in euros, name EU clients, and — decisively — we source and represent engineers who live in EU Member States. Being a Moldovan company does not put us outside the GDPR, and we do not argue that it does.

United Kingdom — UK GDPR, where we source UK-based candidates or serve UK clients. The UK relaxed its rules on automated decisions in February 2026. We have not taken advantage of that, because doing so would breach the EU rules for our EU candidates. We build to the stricter standard once.

Where a national rule is stricter than the GDPR baseline — German retention limits for rejected applicants, for example — we apply the stricter national rule to people in that country. We say where in §10.

4. Website visitors

4.1 What talentsync.eu actually does

We want to be specific, because most privacy policies describe a website the company does not have.

talentsync.eu is a set of static pages. There are no accounts, no logins, and no forms of any kind — no contact form, no newsletter signup, no CV upload. Every way of reaching us is a plain link:

• mailto: links open your own email client. Nothing is sent to us until you press send in your own software.
• A tel: link dials from your own phone.
• A Calendly link takes you to calendly.com, a separate website. The scheduling widget is not embedded in our page — nothing from Calendly runs while you are on talentsync.eu.
• A LinkedIn link to our company page.

While you are on talentsync.eu, your browser contacts no server other than talentsync.eu. No analytics, no font CDN — the Montserrat typeface is served from our own domain — no chat widget, no heatmap, no A/B testing, no session recording, no advertising pixel, no social embed, no map.

4.2 What we process about every visitor

We do not build visitor profiles from server logs. We do not know who you are. We cannot link a log entry to a person, and we do not try.

4.3 Analytics: we do not run any

There is no analytics on this website. No Google Analytics, no self-hosted analytics, no page-view script of any kind. Nothing counts you, nothing profiles you, and nothing is stored on or read from your device — which is why you will not be asked to answer a cookie banner.

We use the two search-console tools below. They run on the search engines’ own servers rather than on ours, and they place nothing on your device.

We count page requests in our own server logs instead. That needs no consent, because it involves nothing stored on or read from your device, and those logs are deleted after 30 days (§4.2).

If we ever add analytics, this policy and the cookie policy are updated before the tool ships — not after — and we ask for your consent before anything is set on your device. We would name the tool, what it collects, who receives it and how long it is kept, here, first. Refusing would be exactly as easy as accepting and would change nothing about the site.

4.4 Calendly

If you click “Book a call”, you leave our website for calendly.com. Nothing is transmitted to Calendly until you click.

We are the controller of your booking. Calendly LLC processes your name, email address, chosen time and any note you add on our behalf, as our processor under its data processing addendum. Calendly is a separate controller only for its own operation of the platform, described in its own privacy notice. Exercise your rights over the booking with us — you do not need to contact Calendly.

We hold the resulting record as part of the client-contact processing described in §5. You never have to use Calendly: emailing victor@talentsync.eu or calling +373 68 300 700 reaches the same person and involves no third party at all.

5. Clients and prospective clients

This section is about individual people at companies — a CTO, a founder, a head of engineering, a finance contact. Data protection law has no “B2B exemption”: your name and work email are your personal data even when you are acting for your employer.

5.1 What we do and why

Currently published: three testimonials with photographs, on our homepage. Each is published with the named person’s agreement, and we remove any testimonial on request.

5.2 Interview feedback and information about your employees

Some clients send us data about people who are not us and not our candidates — for example a hiring manager’s calendar, an existing team member’s details, or written interview feedback about a candidate.

When you send us that, you are the controller and we are a recipient. Please send only what we need, and tell us if anything in it is sensitive. Where we act on your documented instructions for a defined task, we act as your processor and we will sign a data processing agreement on Article 28 terms. Where we decide for ourselves what to do with the information — which is the normal case for candidate data — we are a controller in our own right and this policy governs it.

5.3 What clients should read next

Annex B lists the documents we will provide to your procurement, security or legal team without argument.

6. Candidates and engineers

This is the longest section because it carries the most at stake. It covers anyone we have sourced, contacted, screened, represented, placed, or kept in our talent pool.

6.1 Our role, stated plainly

For candidate data, TalentSync is an independent controller. We decide which engineers to approach, what to record about them, how to validate their experience, whether to keep them in the pool after a rejection, and which clients to show them to. Those are our decisions, not a client’s instructions, so we take responsibility for them.

Three consequences follow, and we want you to see all three:

1. You can exercise every right in §12 directly against us. We do not send you to a client and call it their problem.
2. When we share your profile with a client, that client processes it as a controller for its own hiring process, under its own privacy notice. For the act of sharing we are joint controllers with that client. You may bring any request or claim to either of us: Article 82(4) makes each of us liable for the whole of any damage caused, and nothing in our contracts with clients changes that. We choose which clients we send profiles to, and we name the client and ask you before we send anything.
3. Every client agreement we sign therefore allocates, in writing: who answers your access request, who gives you privacy information at each stage, who notifies whom of a breach, and who deletes what if you ask. The essence of that arrangement is set out at §6.9. You may exercise your rights against either of us, whatever the arrangement says.

We are not a project outsourcing company, and this is not a legal nicety — it shapes who controls what. Our clients add engineers to their own teams and retain full technical and operational control. That means the client, not us, controls the day-to-day working relationship and the data it generates.

6.2 Where we get your data

What we deliberately do not do. We do not run scrapers, crawlers or bots. We do not buy scraped candidate databases. We do not resell profiles. We do not look at your personal social media — Facebook, Instagram, X, TikTok, personal blogs — even where it is public, because it is intrusive, it risks exposing information about your health, beliefs, politics or family that we have no business knowing, and it tells us nothing about whether you can write good Go. Our sourcing is a person, manually, on professional platforms, for a role that actually exists.

6.3 What we collect — and what we refuse to

We collect: name; the professional contact details you have made available or given us; current and past job titles and employers; the URL of your public professional profile; skills, technologies and seniority; location and time zone; work-authorisation status where a role requires it; languages; education and certifications; the CV you send us; our notes from conversations with you; your salary or rate expectations and availability; the roles we have discussed with you and the outcome; and a record of your contact preferences and any objection you have raised.

We do not ask for, and we do not want:

• a photograph — do not put one on the CV you send us;
• your date of birth, age, marital status, family situation or nationality, unless a specific legal requirement for a specific role makes it necessary and we have explained why;
• health information, including any explanation of a gap in your CV;
• your race or ethnic origin, religion, political opinions, trade-union membership, sex life or sexual orientation, or biometric or genetic data;
• any criminal record information. See §6.7.

If any of that arrives anyway — CVs leak it whether anyone intends to or not — we delete or redact it before your profile goes to a client, and we never use it in any assessment or decision. If a client ever asks us to screen on any of it, we refuse in writing.

6.4 Sourcing you from a public profile

This is where most recruiters are quietly non-compliant, so here is exactly what we do.

The lawful basis is legitimate interests, Article 6(1)(f) — ours, in matching experienced engineers to live client mandates, and yours, in hearing about relevant work. We have carried out and documented a written legitimate-interests assessment, which we will show you on request.

The one-line balance: an engineer who maintains a public profile on a professional, jobs-oriented platform reasonably expects to be contacted by a recruiter about a specific, relevant, existing role; we limit ourselves to role-relevant professional fields from professional platforms only, we tell you at the first message, and a single word from you stops it permanently.

What limits us:

• we source only for a live mandate or a specific, currently active search — not to inflate a database;
• we record only role-relevant professional fields — the list in §6.3, nothing beyond it;
• professional platforms only — never personal social media, never protected or private forums, never anything behind a login you did not intend recruiters to see;
• no automated collection — no scraping tools, no bulk extraction, no purchased lists;
• no inference — we do not guess at your age, ethnicity, health, family plans or anything else, from your name, photo, graduation year or career gaps;
• two channels only. We contact engineers by email and on LinkedIn. We do not use WhatsApp, Telegram or SMS for candidate outreach.

Our Article 14 commitment. When we obtain your data from a source other than you, the law requires us to tell you. The deadline is not “within a month” — it is the moment we first contact you, because we obtained your details in order to contact you.

That notice is published word for word, on its own page, at talentsync.eu/candidate-privacy/ — so you can check that what we sent you matches what we publish.

We do not keep profiles of people we have not written to. If we record a profile while searching and then decide not to approach you, we delete it within 30 days, and you will never hear from us. If we do write to you and you never reply, we delete what we hold about you six months after we sourced it. No reply means no relationship, and there is no justification for keeping a record of a conversation that never happened.

6.5 What we do with candidate data

The suppression record, in full. We keep a one-way (SHA-256) hash of your email address and a one-way hash of your profile URL, and nothing else — no name, no employer, no notes, no history. We cannot reverse either hash. It exists only so an automated check can stop us contacting you again, which is why we keep it indefinitely; deleting it would mean re-sourcing you next quarter. Ask us and we will confirm whether you are on it.

6.6 Special-category data

We do not seek it, we do not want it, and we have no realistic legal condition for holding it. If you volunteer it — a health condition explaining a career break, a religious observance affecting availability, trade-union involvement — we will delete or redact it rather than pass it on, and it plays no part in any assessment.

The only exception is a genuine, specific accommodation you ask us to arrange for an interview. In that case we ask for your explicit consent to pass on the minimum needed to make the arrangement, we tell you exactly what we will say, and we delete it once the interview is done. You can refuse and still be represented.

6.7 Criminal records: we do not touch them

We collect no criminal-conviction or offence data, we request none, and we forward none. The law permits processing it only under official-authority control or where a specific national law authorises it, and no such authorisation exists for a private Moldovan recruitment intermediary. If a role requires a background check, the client carries it out after handover, under its own national law and with its own legal basis. Our client contracts say so.

6.8 We do not screen you with AI

We do not use automated decision-making or AI screening to evaluate candidates. No AI scoring, no CV-ranking algorithms, no automated filtering. Every shortlist we send is assembled by a person who has read your profile, and every rejection is a human decision with a human reason we can explain to you.

We say this for a legal reason as well as an ethical one. Where a recruiter produces an automated score and the client hires off the top of the list, the recruiter — not the client — is the one making the decision, with all the obligations that follow. We prefer not to be in that position, and you probably prefer we were not either.

If this ever changes, we will update this section before deploying anything, we will complete a data protection impact assessment first, we will keep a human who can and does overturn the tool’s output, we will record every override, and you will keep the right to a human review, to state your case, and to contest the outcome.

We also do not use, and will refuse to use, any tool that claims to infer emotion, enthusiasm, confidence or honesty from your face or your voice. Those are prohibited outright in the EU, and they do not work.

6.9 Joint controllership with clients: the essence of the arrangement

Where we and a client are joint controllers for the act of sharing your profile, our agreement with the client provides, in substance:

You may exercise your rights against either party regardless of this allocation. That is your statutory right and no contract can remove it.

6.10 Engineers engaged under our hourly collaboration model

If you work with a client through our flexible hourly model, the picture is a little different, so here it is separately.

Who you contract with — us, the client, or an employer — is settled in the engagement contract, and we tell you in writing who your counterparty is before you commit to anything. Whichever it turns out to be, the data responsibilities fall as follows.

• We are the controller for the engagement records we hold — the contract we are party to, the identity and tax documents we are required to collect, your bank details where we pay you, the timesheets and invoices we handle, and the record of your engagement — on the basis of contract (Art 6(1)(b)) and legal obligation (Art 6(1)(c)) for tax and accounting filings.
• The client is the controller for everything its systems generate about your work: commits, tickets, code review, access logs, calendar, internal chat, performance conversations. The client retains full technical and operational control of the engagement, which is the whole point of the model — and that control comes with the client’s own data protection responsibilities and its own privacy notice, which the client must give you.
• For timesheets and billing we and the client are likely joint controllers, because we jointly decide what gets recorded and why. The allocation in §6.9 applies, adapted in the engagement contract.

We do not monitor your work. We do not receive your keystrokes, screenshots, activity scores or productivity metrics, we do not ask a client for them, and we will not accept them if offered.

6.11 If you want us to stop

One line of email is enough. “Remove me” is enough. Reply to any message we sent you. You do not need a form, an account, a reason, or a formal request.

We stop immediately. In practice: we remove you from every live search and cancel every scheduled message on the day we read your request, and we confirm in writing within five working days. We do not send a final follow-up, and we do not ask why. We then delete your profile in line with §10, and keep only the hashed suppression record described in §6.5 so that we do not accidentally source you again in six months.

7. People who apply for a job at TalentSync itself

Our careers pages advertise roles at TalentSync — recruiters, business development. Applying means emailing victor@talentsync.eu with a subject line the site prefills. Here we are the hiring employer, not an intermediary.

Do not send us a photograph, your date of birth, your marital status or anything about your health. We do not need any of it and we will delete it.

Applications sent to us for a TalentSync role are never entered into our candidate talent pool or shown to a client. Different purpose, different data, walled off.

8. Who receives your data

We do not sell personal data. We do not share it for anyone else’s marketing. We do not trade candidate profiles.

These are everyone who receives personal data from us, what they get and why. It is a closed list: if we add a recipient that changes the picture materially, we update this table and the “last updated” date at the top.

9. International transfers

We are in Moldova. Most of the people in this policy are not. Here is exactly how data moves, because clients ask and candidates deserve to know.

9.1 Moldova’s status

There is no European Commission adequacy decision for Moldova. Moldova’s own law is a near-verbatim GDPR transposition in force since 23 August 2026, and Moldova ratified Convention 108+ in May 2026 — but neither of those is an adequacy decision and we do not pretend otherwise. Any transfer of personal data from the EEA to us needs its own safeguard.

9.2 The flows, one by one

9.3 What you can ask for

A copy of the safeguards for any transfer that concerns you. Write to victor@talentsync.eu. Clients should see Annex B, which sets out the instruments we sign and why.

10. How long we keep things

Nothing is kept indefinitely except the suppression list, and that exists only so we can leave you alone.

These are not aspirations. The 24-month clock is enforced with a diarised check-in at 22 months and a hard delete at 24. “Review annually” is not a retention policy and we do not run one.

At the end of a period we delete, or we irreversibly anonymise for statistical purposes. Pseudonymised data is still personal data and we do not pretend otherwise.

11. Security

We are a small company and we secure accordingly: fewer systems, fewer copies, fewer people with access.

• Access control. Personal data is reachable only by the people who need it for their job. Every account that can reach personal data requires multi-factor authentication. Access is removed the day someone leaves.
• Encryption. The website is served over HTTPS only. Data at rest in our email and records systems is encrypted by the provider. Laptops use full-disk encryption.
• Minimisation by design. The website has no forms and no database, so there is no candidate database on the public internet to breach. Candidate data lives in a small number of access-controlled business systems, not in spreadsheets on desktops.
• Vendors. The providers listed in §8 are each under a written Article 28 processing agreement with confidentiality, security and sub-processor terms, and an appropriate transfer mechanism.
• Confidentiality. Everyone at TalentSync is bound by written confidentiality obligations and is briefed on this policy and on our sourcing rules.
• Records. We maintain a record of processing activities as required by Article 30. We do not rely on the small-organisation exemption, because recruitment processing is continuous rather than occasional.

Breaches. If a personal data breach is likely to result in a risk to your rights, we notify the CNPDCP and each EU supervisory authority whose data subjects are affected — we have no EU main establishment, so there is no single lead authority — without undue delay and, where feasible, within 72 hours of becoming aware. Where the risk to you is high, we tell you directly, without undue delay, in plain language: what happened, what it means for you, and what we are doing.

No system is perfectly secure and anyone who tells you otherwise is selling something. If you believe you have found a vulnerability in our site or our handling, please write to victor@talentsync.eu. We will respond, we will fix it, and we will not threaten you.

12. Your rights, and how to use them

Your other rights come from the GDPR and from Moldovan Law No. 195/2024 in identical terms. We apply them to everyone in this policy, wherever you live.

12.1 How to exercise them

Email victor@talentsync.eu. That one address reaches the person who answers, and it is the only one you need.

Tell us what you want. There is no form, no template, no portal and no account. “Please delete everything you have on me” is a valid request and we will treat it as one.

12.2 What happens next

• We reply within one month of receiving your request. If it is genuinely complex, or you have made several, we may extend by up to two further months — and we will tell you within the first month if we do, with the reason.
• It is free. We only charge, or refuse, if a request is manifestly unfounded or excessive, and we would explain why and how to challenge that.
• We may ask you to confirm who you are, but only where we genuinely cannot tell — and we will ask for the least intrusive proof that works. If you email from the address we hold for you, that is usually enough. We will not demand a passport scan to answer an email.
• If we cannot do what you asked, we say so, explain why, and tell you how to complain.

12.3 If a client also holds your data

Ask us and we will pass your request to the client and confirm back to you when we have. You do not have to chase two companies to get one thing done.

13. Cookies and similar technologies

13.1 Where we stand

talentsync.eu sets no cookies at all. No analytics, no advertising technology, no cross-site tracking, no data broker, no marketing pixel, no fingerprinting, no session recording, no local storage and no session identifier. Nothing is stored on your device and nothing is read from it.

That is why you will not be asked to answer a cookie banner: there is nothing to consent to, and a banner asking you to accept technology that does not run would be noise rather than a choice. This is the design, not an oversight, and we intend to keep it for as long as we can.

The Montserrat typeface is served from our own domain, so reading this page does not hand your IP address to a font CDN either. The one record our server keeps is the access log described in §4.2 — not a cookie, and deleted after 30 days.

13.2 Search consoles, and what would change if we added anything

Google Search Console and Bing Webmaster Tools set no cookies on our site. They report aggregated statistics that Google and Microsoft already hold from their own search results. Nothing is placed on your device and no consent is needed.

If we ever add analytics, or any other non-essential technology, these are commitments and not intentions:

• This policy and the cookie policy are updated first — naming the tool, what it collects, who receives it and how long it is kept — before the tool ships, not after.
• A consent banner appears before any cookie or identifier is set, with every signal defaulting to denied until you choose.
• Rejecting will be exactly as easy as accepting — same screen, same prominence, one click, no pre-ticked boxes, no dark patterns, no “legitimate interests” tab hiding switches you have to turn off individually.
• Closing the banner without choosing will count as a refusal.
• You will be able to change your mind at any time, and withdrawal will take effect immediately.
• Refusing will cost you nothing. The site will be identical either way. There will be no cookie wall.

13.3 The full cookie policy

A dedicated cookie policy sets out in full what this site does and does not store in your browser, and lists every cookie by name, purpose, provider, type and lifetime the moment there is one to list. Where this section and that page differ, that page is more detailed and more current.

13.4 A standing commitment

Adding a chat widget, an embedded booking widget, a LinkedIn Insight tag, a YouTube embed, a heatmap tool or a hosted form would each add a third party to §8, and most of them would store something on your device. We treat that as a decision with consequences, not a quick task: this policy and the cookie page are updated before any such thing ships — not after. The engineering rule is simple: if a new third-party domain appears in the network tab, the cookie page is out of date and must be updated before release.

14. Automated decision-making and AI

We do not use automated decision-making or AI screening to evaluate candidates. We do not make decisions about you by automated means alone, and we do not profile you.

Specifically, and stated so you can hold us to it:

• no automated CV scoring;
• no algorithmic ranking of candidates;
• no automated rejection;
• no AI-driven video interview analysis;
• no tool that claims to infer emotion, personality, enthusiasm or honesty from your face, voice or writing;
• no automated inference of protected characteristics from your name, photo or career history.

Every shortlisting decision is made by a person who has read your profile. Every rejection has a human reason, and we will give it to you if you ask.

If we ever adopt AI assistance, we will complete a data protection impact assessment before deploying it, update this section first, keep a human reviewer with real authority to overrule the tool, log every override, and preserve your right to human intervention, to express your point of view and to contest the outcome.

15. Children

Our services are for working professionals and our website is aimed at businesses. We do not knowingly collect personal data from anyone under 16, and we have no reason to.

If you believe a child’s data has reached us, write to victor@talentsync.eu and we will delete it promptly.

16. Changes to this policy

We update this policy when what we do changes — a new tool, a new recipient, a new purpose, a change in the law.

• The version number and “last updated” date at the top always reflect the current text.
• Annex C records what changed and when.
• For a change that materially affects you — a new purpose, a new category of recipient, a longer retention period, or the introduction of automated decision-making — we will tell you before it takes effect, by email where we hold your address, and we will not apply it to data we already hold without a lawful basis for doing so.
• We do not make material changes retroactively and we do not rely on “your continued use of the site constitutes acceptance”. That is not consent and we will not pretend it is.

Where this policy starts. Every engineer whose data we held on the date at the top of this page was sent this notice by email on that date. Before that date our sourcing practice was not documented to this standard; this policy describes what we do from that date onward.

17. Complaints

Please come to us first — victor@talentsync.eu. Most things are a misunderstanding we can fix in a day, and we would rather fix it than read about it from a regulator.

But you never have to come to us first, and you can go to a supervisory authority at any time, whether or not you have contacted us.

17.1 Moldova — our supervisory authority

Centrul Național pentru Protecția Datelor cu Caracter Personal (CNPDCP) — National Centre for Personal Data Protection. 48 Serghei Lazo Street, MD-2004 Chișinău, Republic of Moldova. Telephone +373 22 820 801 · centru@datepersonale.md · datepersonale.md

17.2 European Union / EEA

If you are in the EU or EEA, you can complain to the data protection authority of the country where you live, where you work, or where the problem happened. You do not have to complain in Moldova, and you do not have to travel or write in a foreign language.

Because we have no establishment in the EU, the “one-stop shop” does not apply to us — which is good news for you: your own national authority is competent to handle your complaint directly. The full list is published by the European Data Protection Board at edpb.europa.eu.

We have not appointed an Article 27 representative in the EU — see §1.3. Until we publish one, write to us directly at victor@talentsync.eu. That does not limit your right to complain to your own authority, and you never have to go through us to use it.

17.3 United Kingdom

Information Commissioner’s Office (ICO) — Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom. Helpline 0303 123 1113 · ico.org.uk/make-a-complaint

17.4 Courts

You also have the right to an effective judicial remedy, and to compensation for damage caused by a breach of data protection law. Nothing in this policy limits that.

Annex A — Information for candidates whose data we obtained from public sources

This is our Article 14 notice. It is included in full in the first message we send to any engineer we sourced from a public profile — every first message, without exception.

It is published in full, word for word, as its own page: talentsync.eu/candidate-privacy/. That page also carries the short version we use where a channel cannot take the full text, and the internal rules we hold ourselves to when we use it. It lives at its own URL so that it can be linked from an outreach email, read on its own, and checked against what we actually sent you.

It is not reproduced here as well. One notice, one canonical text, one place to change it.

Annex B — What a client can ask us for

We will supply all of the following without argument or an NDA fight. Ask victor@talentsync.eu.

The transfer instrument, for your counsel. Where an EEA or UK client sends us personal data, the client is the exporter. We sign the client’s preferred instrument — the 2021 EU SCCs (Module One), the UK IDTA, or the UK Addendum — and, because we are directly subject to the GDPR under Article 3(2), we additionally warrant direct GDPR compliance in the services agreement, which is the substantive protection Chapter V is there to secure. We will re-paper if and when the Commission adopts clauses for importers already subject to the GDPR.

One thing we will decline: we will not sign a processor DPA that describes us as processing candidate data solely on your instructions. It is not true, it contradicts this published policy, and a documented inconsistency between a company’s contracts and its privacy notice is worse for both of us than getting the paperwork right. For the hourly collaboration model, where an engineer touches your systems and your data, processor terms are exactly right and we sign them.

Annex C — Version history

This policy describes how TalentSync handles personal data. It does not create contractual rights beyond those the law already gives you, and nothing in it limits your statutory rights.