Privacy Policy

Overview

Competrace ("we", "our", or "us") is committed to protecting your privacy. This policy explains how we collect, use, and safeguard your personal data when you use our competence-tracking platform.

Our Role

We act in two capacities. For your account and login details, we are the data controller. For the employee evaluation data your organization records in Competrace (skill ratings, review notes), your employer is the controller and we act as a data processor on their behalf, handling that data only on their instructions. Requests about evaluation data may need to be directed to your employer.

Data We Collect

• Account information: Name, surname, and email address
• Evaluation data (as processor): Skill ratings, assessment records, and free-text assessor notes entered by your organization
• Authentication data: Session cookies to keep you signed in
• Activity records: Entries in your organization's activity log, the date you accepted our Terms and Privacy Policy, and short-lived records of sign-up, login, password-reset and in-product feedback attempts — your email address and IP address — used for rate-limiting.

Lawful Basis

• Contract (Art. 6(1)(b)): Creating and operating your account to deliver the service you or your employer signed up for.
• Legitimate interests (Art. 6(1)(f)): Keeping the service secure and preventing abuse (for example, login rate-limiting), and keeping an activity log so your organization can show who made which decision.

Employee evaluation data is processed on the lawful basis established by your employer as controller.

Data Storage & Security

Your data is stored in the European Union (Frankfurt, Germany). We use industry-standard encryption for data in transit and at rest, row-level access controls that isolate each organization's data, and rate-limiting on authentication. Access to personal data is restricted to authorized personnel only.

Cookies

We use only strictly necessary and functional first-party cookies. We do not use analytics, advertising, or tracking cookies, so no cookie banner is required.

• Supabase authentication cookies — keep you securely signed in (strictly necessary; session-based).
• sidebar_state — remembers whether the sidebar is open (functional; persists in your browser).

Sub-processors & International Transfers

We do not sell your data. We rely on a small number of trusted sub-processors to run the service. Some are based in the United States, so limited data (such as email addresses) may be transferred there under appropriate safeguards (EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework). The current list is on our sub-processors page.

Payments & Billing

Paid subscriptions are processed by Paddle.com Market Ltd ("Paddle"), which acts as our Merchant of Record and as an independent controller for payment and tax processing. When you subscribe, billing-related personal data — such as your name, billing address, and VAT ID — is shared with Paddle so it can process payments and collect and remit tax. Paddle handles your payment card details directly; Competrace does not receive or store your full card number. Paddle is listed on our sub-processors page, and its own handling of your data is governed by Paddle's privacy policy.

Data Retention

We retain your account data for as long as you are a member of an organization on Competrace. Your membership is controlled by your employer: when they remove you, your membership and the evaluation records about you are permanently deleted, and your login account is deleted once you no longer belong to any organization. Removal is permanent and cannot be undone. Assessments and reviews you wrote about colleagues are retained for your employer as controller, but are no longer linked to you. Deleted data may persist in encrypted backups until those backups rotate out on their normal cycle.

Separately, your organization keeps an activity log of actions taken in Competrace — for example inviting or removing a member, changing someone's role, level, or department, starting or finalizing an assessment, editing the competency framework, or changing the subscription plan. It also records two things you do to your own account: changing your password, and exporting your data. Each entry records the name of the person who acted and the person affected as those names stood at the time, the action, the date, and the before-and-after value of the single field that changed. It contains no ratings and no free text, and it is visible only to your organization's administrators.

We do not delete activity log entries on a schedule. They are kept for as long as your organization's account exists and are deleted with it. Removing a member does not remove the entries that name them.

Your Rights

Under GDPR and applicable privacy laws, you have the right to access, rectify, erase, and export your personal data, and to restrict or object to its processing. Export is self-service in your account:

• Access & export: Download your data as JSON from Settings → Your data & privacy.
• Erasure: Ask your organization's administrator to remove you — removal permanently deletes your membership and the evaluation records about you, except entries in your organization's activity log. Those are retained under Art. 6(1)(f) and Art. 17(3)(e), so the record of who made which decision survives the departure of the people involved. If you believe an entry about you should not be kept, email us at the address below. Where we cannot rely on Art. 17(3)(e), we replace your name with "Erased user" wherever the entry names you — as the person who acted and as the person affected — and unlink the entry from you. The other person's name and the record of the action itself remain. You can also address a deletion request to us rather than to your administrator.
• Rectification, restriction & objection: Email us using the address below.

For anything not available in-app, or to correct evaluation data held by your employer, email support@competrace.com. We will verify your identity and respond within one month, as required by GDPR Article 12.

Contact Us

For privacy inquiries, data requests, or questions about this policy, contact us at support@competrace.com.