EU GDPR & Data Protection

Privacy Policy (EU GDPR)

Comprehensive information regarding personal data processing when utilizing the Aproqo platform pursuant to Articles 13, 14, and 28 of the General Data Protection Regulation (GDPR).

Section 01

Data Controller

The responsible controller for data processing operations under the EU GDPR is:

Aproqo

Operated by Erik Ramsperger

Deterministic HR Diagnostics & Candidate Matching

Email: hello@aproqo.com

Website: https://www.aproqo.com

Section 02

Data Processing Roles & Data Processing Agreement (Art. 28 GDPR)

Aproqo delivers a Software-as-a-Service (SaaS) solution exclusively for commercial enterprise clients (B2B). Regarding account administration, user credentials, and subscription billing, Aproqo acts as an independent Data Controller (Art. 4 No. 7 GDPR).

When corporate clients upload applicant documents (e.g. resumes, CVs, competency profiles, assessment notes) into the software, Aproqo processes this personal data exclusively on behalf and under instructions of the client as a Data Processor pursuant to Art. 28 GDPR. The corporate client remains the sole controller responsible for their respective recruitment procedures. We provide a standardized Data Processing Agreement (DPA) including verified Technical and Organizational Measures (TOMs).

Section 03

Purposes and Legal Bases of Processing

Performance of Contract (Art. 6(1)(b) GDPR):Providing our deterministic evaluation SaaS, tenant workspace isolation, team invitation management, criteria calibration, and 100-point scorecard generation.
Legitimate Interests (Art. 6(1)(f) GDPR):Ensuring platform resilience, cybersecurity, abuse and scraping prevention, as well as preserving audit trails for objective score validation.
Legal Obligations (Art. 6(1)(c) GDPR):Compliance with statutory tax, accounting, and commercial retention obligations for payment and billing records.

Section 04

Sub-Processors & Data Processing Principles

Exclusion of AI Model Training (Zero Data Retention)

Candidate resumes, client requisitions, and assessment criteria are never under any circumstance used to train, fine-tune, or optimize any public, private, or foundation artificial intelligence models. Document extraction and point verification run ephemerally through enterprise API instances without persistent storage for model refinement.

Google Cloud & Gemini API

Deterministic criteria analysis via enterprise APIs in ISO 27001 certified data centers with zero data persistence.

Clerk Inc.

Authentication and tenant identity management (certified under the EU-U.S. Data Privacy Framework).

Stripe Payments Europe, Ltd.

PCI-DSS compliant subscription billing and invoicing (Dublin, Ireland / EU).

Vercel Inc. (Frankfurt Data Center)

Serverless execution and web delivery hosted in Frankfurt am Main (EU).

PostHog Inc. (EU Cloud Frankfurt)

Product usage analytics, technical error diagnostics, and session recording hosted in ISO 27001 certified EU data centers in Frankfurt am Main (Germany).

Section 05

Transparency & Human-in-the-Loop Safeguards (Art. 22 GDPR)

Aproqo operates strictly as an assistive evaluation matrix and calibration platform for hiring teams:

Human-in-the-Loop: Aproqo produces zero autonomous hiring, promotion, or rejection decisions. The platform functions strictly as an assistive diagnostic matrix. Ultimate employment determinations rest solely with authorized human decision-makers.
Verifiable Evidence Citations: Every awarded point maps to precise document excerpts from the candidate resume. No unexplainable black-box weights exist.
Focus on Qualification Criteria: Scoring evaluates candidate qualifications strictly against the client's defined must-have and nice-to-have criteria.

Section 06

Your Statutory Rights as a Data Subject (Art. 15–22 GDPR)

Under the EU GDPR, you retain the following enforceable rights regarding your personal data:

Right of Access (Art. 15): Obtain confirmation and copies of personal data processed.

Right to Rectification (Art. 16): Correct imprecise or incomplete records.

Right to Erasure (Art. 17): Request permanent deletion of records when lawful basis ceases.

Right to Restrict Processing (Art. 18): Restrict processing under statutory conditions.

Data Portability (Art. 20): Receive personal data in a structured, machine-readable format.

Right to Object (Art. 21): Object to processing based on legitimate interests (Art. 6(1)(f)).

To exercise any of these rights, contact us at hello@aproqo.com. You also maintain the right to lodge a formal complaint with an EU data protection supervisory authority.

Section 07

Cookies, Analytics & Data Security

Cookies & Product Analytics: Aproqo utilizes strictly necessary session cookies (e.g. for authentication status via Clerk) and functional cookies for language preferences, as well as the product analytics platform PostHog (hosted in EU Cloud Frankfurt) for technical error diagnosis and platform optimization. We deploy no third-party advertising or cross-site commercial marketing networks.

State-of-the-Art Encryption: All data in transit is protected by TLS 1.3 with Perfect Forward Secrecy. Data at rest in databases is encrypted utilizing AES-256 bit algorithms.