How Marple processes personal data on a customer's behalf: the roles, the categories, the suppliers and the safeguards. Customers who need a signed data processing agreement should ask us for one, and this page describes what it covers.
The personal data a customer holds in their Marple workspace, which is to say candidates, clients, contacts, applications, notes and the messages exchanged with them. It does not cover the account data of the customer's own team, which we hold as controller and describe in the privacy policy.
The customer is the controller of their workspace data: they decide what to collect, why, and how long to keep it. Letzbytes is the processor: we act on the customer's instructions, and using the product is how those instructions are given. We do not determine the purposes of the processing, and we do not process workspace data for any purpose of our own.
The subject matter is the provision of a recruitment platform. The purpose is to let the customer run recruitment: holding records, searching them, communicating with people, and producing the drafts and rankings the product offers. The processing lasts as long as the subscription, and ends when the workspace is deleted.
Data subjects are candidates, applicants, client contacts and prospects a customer has researched. The categories are identification and contact details, professional history and qualifications, the content of CVs and application forms, correspondence, and the notes and assessments a recruiter records. Customers should not put special category data into Marple, and the product does not ask for any.
We process workspace data only on documented instructions. We bind everyone with access to confidentiality. We keep the security measures described below. We help the customer answer requests from data subjects and meet their own obligations. We notify the customer without undue delay if we become aware of a personal data breach affecting their workspace. We delete or return the data at the end of the agreement.
We use European cloud hosting for the application and its data, Amazon Bedrock in a European region for the models, an email provider for the messages the product sends, and Stripe for payments. Each is engaged under a written agreement imposing the same obligations we carry. We will name them on request, and we tell customers before adding one so they have the opportunity to object.
Workspace data is processed inside the European Union, including by the models. The exception is payment processing through Stripe, which involves no candidate data. Where any transfer outside the EU becomes necessary, it will be covered by an adequacy decision or by standard contractual clauses, and customers will be told before it happens.
Data is encrypted in transit and at rest. Every workspace is isolated, and the isolation is enforced in the data layer rather than left to each query. Access inside the product is governed by per-permission roles the customer configures. Two-factor authentication and passkeys are available on every account. Administrative access on our side is limited to the people who need it and is logged.
We help customers answer access, correction, deletion, restriction, portability and objection requests, using the product's own capabilities where they exist and by hand where they do not. We also help with data protection impact assessments and with prior consultation where a customer needs to carry one out.
A customer can export their data at any time while the subscription is live. When the agreement ends, the workspace is deleted, including backups on their ordinary rotation, unless the law requires us to keep something for longer.
We make available the information a customer needs to demonstrate that these obligations are met, and we will answer a reasonable audit request. Where an audit is carried out in person, we ask for reasonable notice and that it does not disrupt the service for other customers.
Write to us at hello@letzbytes.lu and we will answer. If you are a candidate rather than a customer, say which organisation you dealt with, so we can point your request to the right place.
