1. Data Controller
The data controller for the processing of personal data through the tenperzent.com platform (the "Platform") is:
Argon Servizi di Impresa srl
Email: tenperzent.com@gmail.com
For any questions regarding data protection or to exercise your rights, please contact us using the details above or through our contact form.
2. Scope & Applicability
This Privacy Policy applies to all users of the Platform, including recruiters, hiring managers, and any individuals whose personal data is processed through the Platform (including candidates whose CVs are uploaded). This policy is governed by the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Italian Legislative Decree 196/2003 (as amended by Legislative Decree 101/2018), and all other applicable data protection laws.
3. Categories of Personal Data We Collect
3.1 Data You Provide Directly
- Account data: Full name, email address, password (hashed and salted)
- Contact form data: Name, email address, message content
- Billing data: Payment information processed securely through Stripe (we do not store credit card numbers)
3.2 Candidate Data Uploaded by Users
- CV/résumé documents and candidate data files (PDF, DOCX, XLSX, XLS, CSV, and other supported file formats)
- Candidate names, email addresses, phone numbers, locations
- Employment history, education, skills, and qualifications
- Any other personal data contained within uploaded documents
⚠️ Important Notice on Candidate Data
Argon Servizi di Impresa srl acts as a data processor with respect to candidate data uploaded by users. The user who uploads candidate data is the data controller for that data and bears full responsibility for ensuring they have a lawful basis for processing, including obtaining any necessary consent from candidates. See Section 10 for full details.
3.3 Automatically Collected Data
- Technical data: IP address, browser type and version, operating system, device type
- Usage data: Pages visited, features used, analysis results, interaction timestamps
- Cookie data: See our Cookie Policy for full details
4. Purposes & Legal Bases for Processing
| Purpose | Legal Basis (Art. 6 GDPR) |
|---|
| Providing the Platform and its core functionality (account management, CV screening, AI analysis) | Performance of contract (Art. 6(1)(b)) |
| Processing payments and managing billing | Performance of contract (Art. 6(1)(b)) |
| Sending transactional emails (confirmations, password resets, service notifications) | Performance of contract (Art. 6(1)(b)) |
| Responding to contact form inquiries | Legitimate interest (Art. 6(1)(f)) — responding to your request |
| Platform security, fraud prevention, abuse detection | Legitimate interest (Art. 6(1)(f)) |
| Compliance with legal and regulatory obligations | Legal obligation (Art. 6(1)(c)) |
| Non-essential cookies and analytics | Consent (Art. 6(1)(a)) |
5. AI Processing & Automated Decision-Making
The Platform uses artificial intelligence to analyse CVs and generate candidate scores, rankings, insights, and recommendations. This processing constitutes profiling under Article 22 GDPR.
Key safeguards:
- AI outputs are advisory only — they are designed to assist human decision-making, never replace it
- No legally binding or similarly significant decisions are made solely on the basis of automated processing
- The user (data controller) retains full control over all hiring decisions
- Uploaded CVs are not used to train, fine-tune, or improve our AI models
- AI processing is performed by third-party AI providers (Google Gemini, OpenAI) under strict data processing agreements
6. Data Sharing & Third-Party Processors
We share personal data only with the following categories of recipients, all of whom act as data processors under written agreements that meet GDPR requirements:
- Cloud hosting & database: Our Platform infrastructure is hosted on secure cloud services with data centres in the EU
- AI providers: Google (Gemini) and OpenAI — for CV analysis only, under data processing agreements. Data is processed transiently and not retained by these providers for training purposes
- Payment processing: Stripe — for secure payment handling (PCI DSS Level 1 compliant)
- Email delivery: For transactional emails (confirmations, notifications)
- Google Analytics: We use Google Analytics to collect anonymised usage data (pages visited, session duration, device type, geographic region) to understand how the Platform is used and improve the user experience. Analytics cookies are only activated with your explicit consent. Google processes this data on our behalf under its Data Processing Terms
- Google Search Console: We use Google Search Console to monitor how the Platform appears in Google search results, including search queries, click-through rates, indexing status, and crawl statistics. This tool processes aggregated and anonymised search performance data and does not set cookies or directly collect personal data from users. Data is managed by Google under its Privacy Policy
We do not sell, rent, trade, or otherwise share your personal data with third parties for their own marketing purposes.
6a. Google API Services — Limited Use Disclosure
TenPerZent's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Compliance statement (verbatim): The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
Specifically, TenPerZent does not:
- transfer user data received from Google APIs to third parties except as necessary to provide or improve user-facing features that are prominent in the application's user interface, and only with appropriate legal safeguards;
- use such data for serving advertisements, including personalised, retargeted, or interest-based advertising;
- allow humans to read such data unless (a) we have obtained the user's explicit consent to read specific data, (b) it is necessary for security purposes, (c) it is necessary to comply with applicable law, or (d) the data has been aggregated and anonymised for internal operations;
- use such data to develop, improve, or train generalised or non-personalised AI and/or machine-learning models.
7. International Data Transfers
Some of our processors (including AI providers) may process data outside the European Economic Area (EEA). Where such transfers occur, we ensure appropriate safeguards are in place, including:
- EU Commission adequacy decisions (where available)
- Standard Contractual Clauses (SCCs) approved by the EU Commission
- Data Processing Agreements with all sub-processors
8. Data Retention
- Account data: Retained for the duration of your active account
- Candidate data (CVs, profiles): Retained for as long as the uploading user's account is active, unless deleted earlier by the user
- Contact form submissions: Retained for 12 months after submission
- Billing data: Retained for the period required by Italian tax and accounting regulations (currently 10 years)
- Usage & technical logs: Retained for up to 12 months
- Account deletion: Upon account deletion, all personal data and uploaded candidate data are permanently and irreversibly deleted within 30 days, except where retention is required by law
9. Your Rights Under GDPR
If you are located in the EU/EEA, you have the following rights under the GDPR. You may exercise these rights at any time by contacting us at tenperzent.com@gmail.com or using our contact form:
- Right of access (Art. 15): Obtain a copy of your personal data we hold
- Right to rectification (Art. 16): Correct inaccurate or incomplete data
- Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
- Right to restriction (Art. 18): Restrict how we process your data in certain circumstances
- Right to data portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format
- Right to object (Art. 21): Object to processing based on legitimate interests
- Right to withdraw consent (Art. 7(3)): Where processing is based on consent, withdraw it at any time without affecting prior processing
- Right to lodge a complaint: File a complaint with your national data protection authority. In Italy, this is the Garante per la protezione dei dati personali (www.garanteprivacy.it)
We will respond to all requests within 30 days, as required by law. In complex cases, this may be extended by an additional 60 days with prior notice.
10. User Responsibilities — Candidate Data & CV Uploads
This section is critically important for all users who upload CVs or candidate data to the Platform.
When you upload CVs, résumés, or any candidate personal data to the Platform, you act as the data controller for that data under the GDPR. Argon Servizi di Impresa srl acts solely as a data processor on your behalf.
As the data controller, you represent and warrant that:
- You have a valid legal basis under Article 6 GDPR to process and upload each candidate's personal data (e.g., legitimate interest in the context of a recruitment process, or explicit consent)
- You have informed each candidate about the processing of their data through AI-powered screening, including the identity of any processors involved, in accordance with Articles 13 and 14 GDPR
- You have obtained any required consents from candidates before uploading their data, where consent is the applicable legal basis
- You are authorised to share the candidate data with third-party processors (including Argon Servizi di Impresa srl and its sub-processors) for the purpose of AI-powered CV screening
- The candidate data you upload is accurate, relevant, and limited to what is necessary for the recruitment purpose (data minimisation principle)
- You will not upload special categories of personal data (Art. 9 GDPR) — such as health data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, sexual orientation — unless you have explicit consent from the candidate and a lawful basis to do so
- You comply with all applicable national and EU employment and data protection laws governing recruitment activities in your jurisdiction
- You will promptly delete candidate data from the Platform when it is no longer necessary for the recruitment purpose
Argon Servizi di Impresa srl shall not be liable for any claim, loss, damage, or regulatory penalty arising from a user's failure to comply with their obligations as data controller, including but not limited to uploading candidate data without a valid legal basis, failing to inform candidates, or uploading data in violation of applicable laws.
If a candidate contacts us directly to exercise their data protection rights (e.g., access, deletion), we will forward the request to the relevant user (data controller) and assist as required under Article 28 GDPR.
11. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including:
- Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
- Row-level security (RLS) ensuring users can only access their own data
- Secure authentication with hashed passwords and session management
- Regular security reviews and access controls
- Strict access controls for employees and contractors
12. Children's Privacy
The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child has provided personal data, we will take steps to delete it promptly.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes by email or through a notice on the Platform. The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of the Platform after changes constitutes acceptance of the revised policy.
14. Contact & Data Protection Inquiries
For any questions, concerns, or requests regarding this Privacy Policy or data protection:
Argon Servizi di Impresa srl
Email: tenperzent.com@gmail.com
Contact form: tenperzent.com/contact