Legal
Privacy Policy
Version draft-1 · Effective [EFFECTIVE DATE]
This policy explains how Commis handles personal data across the marketplace. It applies to everyone; the regional addenda below add the rights and details that depend on where you are.
Who we are
Commis is operated by [LEGAL COMPANY NAME], which is responsible for your personal data as controller [LEGAL REVIEW REQUIRED].
- Legal name
- [LEGAL COMPANY NAME]
- Company number (IČO)
- [IČO / COMPANY NUMBER]
- VAT ID
- [VAT ID]
- Tax ID
- [TAX ID]
- Registered address
- [REGISTERED ADDRESS]
- Company register
- [COMPANY REGISTER]
- General enquiries
- [GENERAL EMAIL]
- Legal
- [LEGAL EMAIL]
- Privacy
- [PRIVACY EMAIL]
Data protection officer: [DPO — LEGAL REVIEW REQUIRED]
Regional addenda
Depending on where you live, additional information and rights may apply. Read the global policy together with the addendum for your region.
What we collect and why
| Who | Data | Why we use it |
|---|---|---|
| Candidates | Identity and contact First and last name, Email address, Age, Gender (optional), Country of origin, Current country and city | Create the candidate account and show the profile to restaurants the candidate applies to. |
| Candidates | Professional profile Languages and levels, Work experience, Culinary education, Skills and cuisines, Years of experience, Short bio, Portfolio, Instagram and LinkedIn links | Present the candidate's experience to restaurants and compute the deterministic profile match score. |
| Candidates | Preferences and availability Preferred countries, cities, cuisines and restaurant types, Availability dates, Paid/unpaid preference, Accommodation need, Willingness to relocate | Rank internships by fit and inform restaurants about availability. |
| Candidates | Profile photo and CV Profile photo, CV (PDF) | Show a profile photo; share the CV with restaurants the candidate applies to. |
| Candidates | Applications and saved internships Applications (message, availability, additional information, CV snapshot reference, match score, status history), Saved internships | Run the application workflow between candidate and restaurant. |
| Restaurants | Restaurant profile and listings Restaurant name, type and cuisines, Address, city, country and map coordinates, Website and Instagram, Michelin Guide link and claimed status, Contact name and email, Photos, Internship listings | Publish the restaurant and its internships on the marketplace. |
| All users | Messages and notifications Chat messages, Read receipts, In-app notifications | Let the two sides of an application communicate and keep users informed. |
| All users | Authentication and security Email and hashed password, Session tokens (cookies), Email verification and password-reset tokens, Auth server logs (IP address, user agent) | Sign users in securely and protect accounts. |
| All users | Reports and audit logs Reports (reason, details, target), Admin actions audit log | Keep the marketplace safe and record moderation decisions. |
| All users | Contact enquiries First and last name, Email address, Who they are (candidate, restaurant, partner, media, other), Topic, subject and message, Optional attachment (PDF, JPG or PNG), Account reference, if signed in | Answer messages sent through the contact page. |
| All users | Cookie consent and preferences Consent choices, version, timestamp, region, Marketing email preference | Remember privacy choices. |
Legal bases
The legal basis for each purpose above will be stated here once confirmed: [LEGAL REVIEW REQUIRED]
Who can see your data
Candidate profiles are never public. A restaurant only sees a candidate's profile and CV after that candidate applies to it. CVs are private files delivered through links that expire after five minutes.
| Data | Public | Candidates | Restaurants | Commis admins |
|---|---|---|---|---|
| Candidate profile, languages, experience, preferences | No | Own only | Only candidates who applied to them | Yes |
| Candidate CV | No | Own only | Only the CV attached to an application they received | Yes |
| Candidate email address | No | Own only | Only applicants (used for status emails) | Yes |
| Applications and status history | No | Own only | Applications to their own internships | Yes |
| Saved internships | No | Own only | No | No |
| Messages | No | Conversations they take part in | Conversations they take part in | Yes (moderation) — [LEGAL REVIEW REQUIRED] |
| Notifications | No | Own only | Own only | No |
| Restaurant profile and published internships | Yes | Yes | Yes | Yes |
| Draft / paused internships | No | Only if they already applied | Own only | Yes |
| Contact enquiries | No | No (write-only) | No (write-only) | Yes |
| Reports | No | Reports they filed | Reports they filed | Yes |
Service providers and international transfers
We use these providers to run Commis. Some may process data outside the European Economic Area; the safeguards used are listed when confirmed.
| Provider | What for | Location | Safeguard |
|---|---|---|---|
| Supabase | Database, authentication, file storage (profile photos, CVs, restaurant images) and realtime chat | Region chosen when the production project is created — [LEGAL REVIEW REQUIRED] | [LEGAL REVIEW REQUIRED] |
| Vercel | Web hosting and server-side rendering | [LEGAL REVIEW REQUIRED] | [LEGAL REVIEW REQUIRED] |
| Resend (if enabled) | Transactional email (application and status emails, contact-form forwarding) | [LEGAL REVIEW REQUIRED] | [LEGAL REVIEW REQUIRED] |
| Google Maps Platform (Google) | Maps on internship and restaurant pages, and address lookup when a restaurant clicks “Find on map” | [LEGAL REVIEW REQUIRED] | [LEGAL REVIEW REQUIRED] |
How long we keep data
Retention periods for each category: [LEGAL REVIEW REQUIRED]. When you delete your account, your data is deleted as described in “Your rights”.
Your rights
Depending on where you are, you may have some or all of these rights. Your regional addendum lists which apply to you.
- Access. Get a copy of the personal data we hold about you.
- Rectification. Correct inaccurate or incomplete data.
- Erasure. Ask us to delete your personal data.
- Portability. Receive data you provided in a machine-readable format.
- Objection. Object to certain uses of your data.
- Withdraw consent. Withdraw consent at any time where we rely on it.
Signed-in users can download their data, correct their profile, manage cookies and delete their account from Privacy & data. For anything else, contact [PRIVACY EMAIL].
Minimum age
Minimum age for using Commis: [LEGAL REVIEW REQUIRED]
Changes to this policy
We will update the version and effective date above when this policy changes.