Privacy Policy

talvia GmbH ("talvia", "we", "us", "our") respects your privacy. This Privacy Policy explains how we collect, use, share, and protect personal data when you use the talvia platform. We aim to comply with the Swiss Federal Act on Data Protection (revFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Data Controller

The data controller for personal data processed via talvia is:

talvia GmbH
Hauflandweg 3, 8605 Gutenswil, Switzerland
UID: CHE-266.016.139
Contact: info@talvia.ch

2. Data We Collect

• Account data: name, email, password hash (or your Google account identifier), authentication provider, and which profiles you have created — talent, company, or both.
• Profile data (talent): headline, bio, skills, certifications, languages, work experience, career break reason, aspirations, location, availability, CV and supporting documents, profile photo.
• Profile data (company): company name, industry, size, mission, vision, values, hiring roles, job descriptions, logo.
• Usage data: log data, device and browser information, IP address, timestamps, interactions with the platform.
• Communications: messages, contact requests, and support inquiries.
• Payment data (companies only): processed directly by Stripe; talvia does not store full card numbers.

3. How We Use Your Data

• Provide and operate the Services, including AI-powered matching between talent and companies;
• Enable companies and talent to discover and connect with each other;
• Personalise recommendations and platform content;
• Communicate with you about your account, opportunities, and product updates;
• Improve the Services, conduct analytics, and ensure security and fraud prevention;
• Comply with legal obligations.

4. Legal Bases (GDPR)

Where GDPR applies, we process personal data on the following legal bases:

• Contract (Art. 6(1)(b)): to create your account and provide the Services;
• Consent (Art. 6(1)(a)): for reading and sharing your CV, marketing emails, and sharing your profile with specific companies;
• Legitimate interests (Art. 6(1)(f)): to secure, improve, and defend the platform;
• Legal obligation (Art. 6(1)(c)): to comply with Swiss and EU law.

CVs and profile fields may include information about ethnic origin, family situation, or health (career break reasons). Where this qualifies as sensitive/special-category data, we rely on your explicit consent (Art. 9(2)(a) GDPR / Art. 6 revFADP) collected when you complete your profile.

5. Sharing Your Data — Sub-processors

We share data only as follows:

• With companies on the platform: a company browsing candidates sees an anonymized profile — your skills, languages, certifications, values and availability, your country rather than your city, and no name, bio, LinkedIn link, contact details or CV. Your identity and your CV become visible to a company only once it holds an active access grant, and every read of your CV is recorded.
• With other talent on the platform: once you complete your talent profile you appear in the talent community directory, where other talent members see your name, photo, headline, city, skills, values and the rest of your profile. Your CV, phone number and email address are never shown there.
• When you accept a contact request: a company or another member can ask to be put in touch with you. Nothing of yours is passed on while the request is waiting. If you accept, your email address, phone number and LinkedIn link are shown to them, and you can close that contact again at any time from your dashboard.
• Legal compliance: when required by law, court order, or to protect our rights.

We rely on the following sub-processors, each under a data processing agreement:

We do not sell your personal data and we do not use it to train third-party AI models.

Transactional email — password resets, contact and connection notifications — is sent over SMTP, and we have not yet contracted a provider for it. No message leaves the platform until we do, and we will name that provider here, with its sending region, before the first one is sent.

6. Data Residency and International Transfers

Your account, your profile, your CV and every document you upload are stored in Switzerland: the database, the object storage and the servers that run talvia are all in Swiss zones at Exoscale. This is a deliberate choice, not a default.

AI processing is the exception, and we are explicit about it. Match scoring sends a job description and a candidate profile to Google's Gemini API, and we have not yet secured an inference region we consider equivalent to the rest of the stack. Until we have, we do not send real candidate CVs to it. We will update this section — naming the region — before that changes. Matching does not depend on it: the automated score is mostly deterministic and computed in Switzerland, and the AI contribution is capped at a fifth of it.

Where a sub-processor does process personal data outside Switzerland or the EU/EEA, we rely on appropriate safeguards, including EU Standard Contractual Clauses (SCCs) with the Swiss addendum, and — where applicable — adequacy decisions recognised by the Swiss Federal Council or the European Commission.

7. Data Retention

• Active accounts: retained for the life of the account.
• Closed accounts: deleting your account removes your profile rows and sweeps your stored files in the same operation, not on a later schedule. Backups are the only remaining copy, and they roll off as below.
• Contact requests and the notes sent with them: retained while your account exists, and removed with it.
• Billing and tax records: retained for 10 years as required by Swiss commercial law (Art. 958f CO).
• Server and security logs: retained for up to 90 days.
• Backups: rolling backups are overwritten within 30 days.

8. Your Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate data;
• Request deletion of your data ("right to be forgotten");
• Object to or restrict processing;
• Data portability (receive a copy of your data in a structured, machine-readable format);
• Withdraw consent at any time;
• Lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your local EU supervisory authority.

How to exercise your rights: email info@talvia.ch from the address linked to your account, or use the "Delete account" option in your dashboard. We aim to respond within 30 days. We may need to verify your identity before acting on a request.

9. Security

We implement technical and organisational measures including TLS encryption in transit, encryption at rest at the hosting provider, and principle-of-least-privilege for staff access. Who may see which candidate data is decided per request in the application, and those rules are covered by automated tests — a company sees an anonymized profile until it holds an access grant, and never the underlying account. Your own profile photo and company logo load through short-lived signed links; a CV, or any file belonging to someone else, is never handed out that way — it is served through an authenticated route that checks the reader's access on every request and records the read. No system is perfectly secure; please use a strong password and keep your credentials confidential. To report a security concern, email info@talvia.ch.

10. Automated Decision-Making

Our AI matching engine produces ranking scores and suggestions to help companies discover talent. These are decision-support tools — final hiring decisions are made by humans at the relevant company. You can request human review of any automated suggestion that significantly affects you by contacting info@talvia.ch.

11. Children

The Services are not directed to anyone under 18. We do not knowingly collect data from children.

12. Updates

We may update this Policy from time to time. We will notify you of material changes via the platform or by email. The "Last updated" date at the top reflects the most recent revision.

13. Contact

For privacy questions or to exercise your rights: info@talvia.ch.