Privacy Policy
1. Who we are
The data controller for this website (panthr.xyz) is Panthr Global S.L., with registered address at Calle Cavanilles, 52, Planta 4, Puerta E, 28007 Madrid, Spain and tax ID (CIF) B75334656 (“Panthr”, “we”). Contact for any privacy matter: [Privacy contact email]. Data Protection Officer: [DPO contact, if appointed].
2. Data we collect
Contact form
When you send the “Tell us about your next critical role” form we process: full name, work email, company, role you are hiring for, seniority, country and service of interest, plus the date of your consent.
Culture test
The culture test pop-up embeds Panthr’s test hosted at panthr-test.vercel.app. It only loads when the pop-up opens. Any answers or contact details you enter there are processed under [confirm: same controller / separate terms for the culture test app].
Technical data
Our hosting provider (Netlify, Inc., USA; transfers covered by the EU–US Data Privacy Framework and Standard Contractual Clauses) processes your IP address and basic request data (server logs) to deliver the site securely. We use no analytics or marketing cookies unless you accept them (see our Cookie Policy).
Job applicants
“Open roles” links to our careers page on Traffit (panthr.traffit.com), which has its own privacy notice.
3. Purposes and legal bases (Art. 6 GDPR)
| Purpose | Legal basis |
|---|---|
| Replying to your enquiry and preparing a proposal | Your consent (Art. 6(1)(a)) and steps prior to a contract (Art. 6(1)(b)) |
| Running the culture test you choose to take | Consent / steps prior to a contract |
| Site security and server logs | Legitimate interest (Art. 6(1)(f)) |
| Analytics and marketing cookies (only if accepted) | Consent (Art. 6(1)(a) GDPR; Art. 5(3) ePrivacy Directive) |
| Legal and tax obligations once we work together | Legal obligation (Art. 6(1)(c)) |
4. How long we keep data
Enquiries: [retention period, e.g. 12 months after last contact], unless a business relationship starts. Server logs: [log retention period]. Contract and invoicing data: as required by law.
5. Who we share data with
Service providers acting as processors under Art. 28 GDPR: hosting (Netlify, Inc., USA; transfers covered by the EU–US Data Privacy Framework and Standard Contractual Clauses), email/CRM [email or CRM provider], the culture-test app host (Vercel Inc.). We do not sell personal data.
6. International transfers
Some providers may process data outside the EEA (for example in the United States or in Mexico, where we have a hub). In that case we rely on an adequacy decision (such as the EU–US Data Privacy Framework) or Standard Contractual Clauses. [list the transfers that apply].
7. Your rights
You can request access, rectification, erasure, restriction, portability and object to processing, and withdraw consent at any time without affecting earlier processing. Write to [Privacy contact email]. You can also complain to a supervisory authority; in Spain this is the Agencia Española de Protección de Datos (aepd.es).
8. Security
We apply appropriate technical and organisational measures to protect your data.
9. Changes
We will publish any changes on this page and update the date above.