Data protection impact assessment

• Talent profiles and accounts.
• Sharing a profile with startups through sector talent pools (with consent) and through intro requests.
• Analytics in tiers: cookie-free aggregate counts, and person-level analytics only after explicit consent.
• Email: newsletter, product and role alerts.

Monitoring job seekers in a way that can be linked to their identity, and that may be disclosed to employers, is the kind of processing the Dutch data protection authority lists as likely to need a DPIA. We assess it before we add new processing, not after.

In general terms: profiling of job seekers, disclosure of a profile to an employer, identifying a person from small numbers, people holding back because they feel watched, unauthorised access to data, and data kept longer than needed.

• Data is hosted in the EU.
• Consent for pool sharing and for analytics, asked separately and withdrawable.
• Data minimisation: counts without identifiers, and only the data a purpose needs.
• Engagement data is never shared with startups.
• Deleting an account removes the profile and the data linked to it; only aggregates are kept.
• Access is limited to the team.

Questions about this summary or our data protection: privacy@startup.career.