Sub-processors
Categories of trusted vendors that may process personal data on behalf of Talent & Co. in delivering our services.
Last updated:
1. Overview
Talent & Co. operates as a boutique, founder-led consultancy. To deliver our services securely and reliably, we rely on a small number of carefully selected sub-processors. A "sub-processor" is a third party engaged by us that may process personal data on our behalf.
Each sub-processor is bound by a written agreement (or equivalent contractual safeguards) requiring it to process data only on our documented instructions, maintain confidentiality, implement appropriate security measures, and assist us in meeting our obligations under the GDPR.
We review our sub-processor list periodically and update this page when material changes occur.
2. Current categories of sub-processors
Lovable (web hosting & content delivery)
- Purpose
- Hosting and serving the talent-and-co.com website and static assets.
- Data categories
- Standard server log data (IP address, browser type, request timestamps).
- Processing location
- European Union / global CDN edge locations.
- Safeguards
- EU-aligned data protection terms; logs retained only for security and operational monitoring.
Email service provider (business email)
- Purpose
- Sending and receiving business correspondence with candidates, clients, and partners.
- Data categories
- Email address, message content, attachments (e.g., CVs voluntarily submitted by candidates).
- Processing location
- European Union / European Economic Area.
- Safeguards
- TLS in transit, access restricted to Talent & Co. principal, retention aligned with GDPR Commitment.
Cloud document storage
- Purpose
- Securely storing engagement documents, candidate files, and working materials.
- Data categories
- Candidate professional information (CV, work history), client engagement notes, contracts.
- Processing location
- European Union.
- Safeguards
- Encryption at rest and in transit, role-based access, periodic access review.
Video conferencing platform
- Purpose
- Conducting virtual interviews, coaching sessions, and client meetings.
- Data categories
- Name, email, meeting metadata. Sessions are not recorded by default.
- Processing location
- European Union / United States (Standard Contractual Clauses where applicable).
- Safeguards
- End-to-end transport encryption; recordings only with explicit prior consent of participants.
3. Client-introduced sub-processors
In recruitment and employer-branding engagements, we frequently work inside our clients' own systems (their applicant tracking system, HR information system, communication platforms, and single-sign-on tools). When we do, those systems remain under the client's control, and the client is the relevant data controller or processor for that environment.
4. International transfers
Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards, primarily the European Commission's Standard Contractual Clauses, supplemented by additional measures where required by applicable case law and guidance.
5. Notification of changes
Material changes to this list — such as adding a new category of sub-processor that materially changes how personal data is processed — will be reflected here and dated above. Enterprise clients with a Data Processing Agreement may also receive direct notification per the terms of that agreement.
6. Related policies
7. Contact
For questions about our sub-processors, or to request a Data Processing Agreement, please contact:
📧
📞 +30 6946 798196 | +44 7743 782073
📍 PO Box 1015, Attica 19003, Greece