Privacy Notice

This privacy notice describes the processing of personal data on the CheckTheSkills website and platform.

The website is currently in active demo and development mode. The demo test phase is currently planned until 31.12.2026. Processes, retention periods, integrations, and organizational procedures are still being refined before regular productive operation.

Please add the operator/company name.

Germany

Contact email: Please add a contact email.

Data protection contact: Not separately configured yet.

Technical operation of the website may involve server- and hosting-related connection data such as IP address, timestamp, requested resource, status code, and user agent where required for delivery, stability, and abuse prevention.

For admin and user accounts, the platform processes in particular email address, optional name, role information, password hash, two-factor status, password reset data, and account activity timestamps.

For test participation, the platform processes in particular invite tokens, optional participant data such as name or email address, answers, test results, timestamps, and status information.

Within the ticket and issue workflow, the platform processes submitted descriptions, priorities, status data, and the association with admin accounts.

For AI-assisted question generation, the platform logs admin email, name, role, topic, question count, status, audit information, and the submitted prompt.

Processing is carried out in particular to provide the website and platform, manage accounts, run technical assessments, secure the system, document privileged admin actions, and further develop the service.

Where processing is required for the use of accounts, test links, password reset, or assessment workflows, it will generally rely on Article 6(1)(b) GDPR.

Where processing serves secure operation, abuse prevention, troubleshooting, auditing of admin activity, or internal development, it will generally rely on Article 6(1)(f) GDPR.

Where statutory retention or evidence obligations apply, processing may additionally rely on Article 6(1)(c) GDPR.

According to the current codebase, the website does not use analytics or marketing cookies.

For signed-in areas, a technically necessary HTTP-only session cookie (`auth_token`) is set. In addition, the frontend stores limited session information in local storage so authenticated interfaces can react correctly.

Under the current implementation, access to the end-user device is limited to technically necessary functions. If analytics, marketing, or other non-essential storage is added later, a consent mechanism under TDDDG/GDPR will be required beforehand.

Personal data may be disclosed to hosting, infrastructure, and email service providers where required for operation, security, and communication.

If admins use AI-assisted question generation, the submitted content may be processed by server-side configured AI tooling. This use is limited to test-question creation and is additionally logged.

Account data, test content, answers, results, tickets, and audit data are generally retained as long as they are needed for the relevant purpose or until deletion is initiated.

Concrete deletion and retention periods have not yet been fully operationalized in the current demo phase and must be finalized organizationally before a production rollout.

Under the GDPR, data subjects generally have rights of access, rectification, erasure, restriction of processing, data portability, and objection.

Where processing is based on consent, that consent can be withdrawn with effect for the future.

Data subjects also have the right to lodge a complaint with a competent data protection supervisory authority.

The platform may evaluate answers and test results in an automated technical manner. However, it is intended as a decision-support tool.

Hiring, staffing, or HR decisions should not be based solely on automated evaluation within the meaning of Article 22 GDPR.

According to the current implementation, the platform uses role-based access, password-protected accounts, optionally enabled two-factor authentication for admins, and separate admin areas.

Technical and organizational measures are reviewed and adjusted continuously as part of ongoing development.