Privacy
statement.
FlexHero processes personal data of candidates, applicants, contact persons and employees. Below you can read which processors and sub-processors we engage and on what basis data may be transferred outside the European Economic Area (EEA). The full privacy statement is available as a PDF.
Contents
1.Processors and sub-processors
To deliver our services, we engage the parties listed below. A data processing agreement (GDPR Art. 28) has been concluded with each processor. Processors that in turn use sub-processors do so under equivalent obligations.
| Party | Role & purpose | Data processed | Location | Outside EEA? |
|---|---|---|---|---|
| Supabase | Database, authentication, file storage and serverless functions (core of the platform) | All platform data: candidate, application, client and housing records | EU (Frankfurt / eu-central) | No |
| Vercel | Hosting and CDN for the public website | Technical logs, IP address, form traffic | US · global edge network | Yes |
| OpenAI (sub-processor) | AI features: CV analysis and summarisation, intake assistant, recruiter coach | CV content and messages the user submits to the AI feature | US | Yes |
| DeepL | Machine translation of vacancy texts | Vacancy text (as a rule, no personal data) | Germany (EU) | No |
| Meta Platforms (WhatsApp) | Sending and receiving WhatsApp messages via the linked business number | Phone number and message content | US / EU | Yes |
| Resend | Sending transactional email | Email address and message content | US | Yes |
| Trengo | Live chat and customer communication on the website | Chat messages, email address, IP address | Netherlands (EU) | No |
| Microsoft (365 / Outlook) | Email synchronisation for the back office | Email content and metadata | EU / US | Yes |
This overview is updated periodically. An up-to-date list of (sub-)processors is available on request via privacy@flexhero.com.
2.Transfers outside the EEA
Where a processor processes data outside the EEA (column "Outside EEA?" = Yes), such transfers take place only with appropriate safeguards as referred to in Chapter V of the GDPR:
- an adequacy decision by the European Commission, including the EU-US Data Privacy Framework for US parties certified under it (GDPR Art. 45); or
- the EU model contract clauses (Standard Contractual Clauses, GDPR Art. 46), supplemented with appropriate technical and organisational measures such as encryption and data minimisation.
We do not transfer more data than is necessary for the purpose concerned and limit transfers to the parties named above.
3.Use of AI processors
FlexHero uses AI services (OpenAI, DeepL) as tools for summarising CVs, supporting intake interviews and translating vacancies. There is no automated decision-making with legal effects within the meaning of GDPR Art. 22: a recruiter always assesses and decides. Data submitted to an AI processor is not used to train that processor's models.
4.Questions or complaints
Questions about these processors, about transfers or about your privacy rights? Email privacy@flexhero.com. You can report security issues via admin@flexhero.com (see also /.well-known/security.txt). If we can't resolve it together, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
