Legal information
Version 1.6, in force as of 24 August 2026
This document describes how Aptessia processes the personal data of your candidate talent pool on your behalf, in accordance with Article 28 of the GDPR. It sets out the commitments contained in the data processing agreement appended to the contract between you and CONCIPI: it is that signed agreement that prevails, and it is provided on request.
When Aptessia is used, the client is the controller: it determines the purposes and means of the processing of its candidates' data. CONCIPI, the publisher of Aptessia, acts as processor: the data is processed only on the client's instructions, in order to provide the service to the client. This allocation applies to the client's own talent pool. The Aptessia shared talent pool is subject to a distinct regime, described below.
Aptessia offers a shared talent pool: a profile that a client publishes there becomes visible to the other client companies. That sharing changes how the roles are characterised, and this article settles the point. As soon as a profile is published in the shared talent pool, CONCIPI is the controller for it: it determines the purposes and means of that pool, and answers for it to candidates and to the supervisory authority alike. The client ceases to be the controller for that profile as regards the shared talent pool; it remains the controller for the file it keeps in its own talent pool. Publication in the shared talent pool is based on the candidate's consent. The client publishes a profile only if the candidate has consented to it, and certifies this at the time of submission. The candidate may withdraw their consent at any time and without giving reasons: their profile is then removed from the shared talent pool, with no effect on applications under way. For as long as a profile has not been revealed, it is presented to the other companies without a name or contact details. Revealing the identity is a logged action, charged to the account that requests it. Data published in the shared talent pool is kept for as long as consent is not withdrawn, and at most two years after the last exchange with the candidate. Candidates are informed about this sharing and about their rights in the privacy policy written for them.
Categories of data processed: candidates' identity and contact details, CVs and career history, results of the tests and interviews generated by the platform. Categories of data subjects: candidates present in the client's recruitment talent pool. Purpose: scoping needs, matching, assessing and following up the client's recruitment.
The data is kept for the term of the client's subscription, then deleted or returned on request within the period set out in the contract following termination, unless a legal obligation requires longer retention.
CONCIPI undertakes to: process the data only on the client's instructions, ensure the confidentiality of the people who have access to the data, implement the security measures described below, assist the client in the event of a request to exercise data subject rights or of a personal data breach, and delete or return the data at the end of the contract.
To provide the service, CONCIPI uses the following sub-processors: Supabase (database and authentication), Scaleway (hosting, France), Mistral AI (language processing for the Aptesse assistant and the AI features, personal data filtered out before any call). Any change to this list is communicated to clients.
Hosting in France (Scaleway, fr-par region), encryption of data in transit and at rest, restricted and logged access, anonymisation of the candidate talent pool, filtering of personal data before any call to an AI model.
For any question about the processing of data or about this document, please write to contact@aptessia.com.