Your data and your rights

If you want your details out of our database, use the form at yellowdesk.ai/opt-out. You do not need an account, you do not need to explain yourself, and you do not need to read the rest of this page.

This page explains what happens after you do, what else you can ask for, and how long we take.

1. Who this is for

You are probably here because you are a decision maker at a company that hires people, and we hold your business contact details: your name, your job title, your employer, your business e-mail address, your business telephone number and your professional profile URL.

You did not give them to us. We obtained them from third-party business contact data vendors, who compile them from public professional sources. The Privacy Policy explains the full picture, including why we did not e-mail you to tell you.

If you are a customer of ours, or a user of a customer's account, most of this page still applies to you, but Settings inside the application handles the everyday things faster.

2. What opting out actually does

When we action an opt-out request:

• Your details are purged from every account that holds them. That includes accounts that paid to reveal them. They do not get a refund and they do not get to keep the record.
• You are never enriched again. Your details cannot be revealed by any customer in future, and you do not appear in the contacts list shown for your company.
• It applies across the whole service, not to one customer or one search.

It is permanent and we cannot undo it. If you later want to be findable again, there is no switch to flip. That is the honest trade for making it real, and it is why the form says so before you submit it.

3. What we keep after you opt out, and why

We keep one thing: a one-way cryptographic hash of the e-mail address or profile URL you asked us to suppress. We do not keep the address itself, and the hash cannot be turned back into it.

We keep it because it is the only way to keep the promise. Our data vendors will supply your record again next month, and the month after. Without something to check against we would have no way of knowing you had already objected, and you would have to object again every few months for the rest of your career. The hash is checked before any contact is displayed and before any reveal.

Keeping a suppression record is necessary to comply with our obligation to honour your objection, and it is a recognised exception to the right to erasure. Article 17(3)(b) GDPR.

4. Why we ask you to confirm by e-mail

The form is public, so anyone can type anyone's address into it. Two things follow, and they are the reason for the extra click:

1. If we acted on an unverified claim, a competitor could erase a recruiter's entire prospect list from a text box, and anyone could erase anyone. 2. If the form behaved differently depending on whether we hold your data, it would become a way of finding out who has been looked up. So it answers the same way every time, whether we hold you or not, and whether the address exists or not.

So a request is recorded as pending, and we send a confirmation link to the address you gave. Only clicking that link makes the request effective. That is you proving you control the address, which is the only proof available to us.

The confirmation link works once. If you did not receive it, check the spam folder, then submit the form again.

5. If you gave us a profile URL rather than an e-mail address

We cannot send a confirmation link to a professional profile, so a profile-only request cannot be self-verified. It is recorded and reviewed by a member of our team, who will contact you to confirm you are the person the profile belongs to before actioning it.

This is slower, and it is deliberate. Suppressing an arbitrary profile URL on an unverified request is exactly the abuse the confirmation step exists to stop.

If you have both, give us the e-mail address. It is immediate and it does not wait for a person.

6. How long we take

Where a request is complex, GDPR allows us up to two further months. If we need them, we will tell you within the first month and say why. We do not expect to need them for a suppression request.

7. The other rights you have

All of these are free. Write to privacy@taliro.net and say which one you want.

Access, Article 15

You can ask for a copy of everything we hold about you. For someone in the contact database, that includes:

• every field we store: name, title, employer, e-mail, telephone, profile URL;
• the name of the vendor each record came from, the identifier it had there, and the date we retrieved it;
• which of our customers revealed your details, and when; and
• whether a suppression request already exists for you.

We name the vendor to you. We describe our vendors by category on the public sub-processor list rather than naming them there, but the person the data is about gets the name.

Rectification, Article 16

If something is wrong, tell us and we will correct it. If your job title or employer has changed, bear in mind that we re-obtain records from vendors, so a correction here may be overwritten by theirs. If what you actually want is to stop appearing at all, opt out instead.

Erasure, Article 17

The opt-out form. It is the same mechanism, and it does more than a targeted deletion would: it stops us re-acquiring you.

Restriction, Article 18

You can ask us to stop using your data while a dispute about it is resolved. In practice we suppress it, which is stronger.

Objection, Article 21

You have an unconditional right to object to processing for direct marketing, and we do not challenge an objection. Because our lawful basis is legitimate interests, you also have the right to object on grounds relating to your particular situation. Either way, the outcome is the same: we suppress you. We do not ask you to justify it and we do not weigh our interest against yours after you have asked.

Portability, Article 20

This right applies where processing is based on consent or on a contract. Ours is based on legitimate interests, so it does not apply to the contact database. We will still give you the access export in a machine-readable format if you ask.

Automated decision-making, Article 22

No decision producing a legal or similarly significant effect on you is made about you by automated means. The buying signal scores companies, not people.

8. Proving who you are

For a suppression request, clicking the confirmation link is the proof.

For an access request we need more, because handing someone else's data to the wrong person is a breach in itself. We will ask you to reply from the address the request concerns, or to provide proportionate identification. We ask for the minimum that answers the question, we do not keep copies of identity documents beyond the time needed to check them, and we do not use anything you send for any other purpose.

9. When we may charge, or refuse

Requests are free. Where a request is manifestly unfounded or excessive, in particular because it is repetitive, the law allows us to charge a reasonable fee or to refuse. We will explain why in writing and tell you how to complain if you disagree. We do not expect to use this.

10. If you are not happy with how we handled it

Tell us: privacy@taliro.net. We would rather fix it than be told about it by a regulator.

You can complain directly to the Spanish supervisory authority, and you do not have to come to us first:

Agencia Española de Protección de Datos (AEPD) C/ Jorge Juan, 6, 28001 Madrid, Spain www.aepd.es

If you live in another EU or EEA country you can complain to your own national supervisory authority instead.

11. If a recruiter contacted you

If someone has approached you using details they obtained through Yellowdesk:

• Ask them to stop. They are required by our terms to honour that directly, without sending you to us.
• Opt out here as well, which stops anyone else obtaining your details in future.
• If the approach broke the rules on unsolicited calls or e-mails, that is a matter for the company that contacted you, and you can complain about them to your national authority. Tell us too: our terms require customers to screen numbers against the national registers and to have their own lawful basis, and a customer who does not is in breach of a contract with us that we can act on.

12. Contact

privacy@taliro.net Taliro Global Talent, S.L., Rambla de Badal 62, 3-3, 08014 Barcelona, Spain