Skillties logoSkillties word mark

Privacy Policy

Version: August 26th, 2026

Applicable law: EU General Data Protection Regulation (GDPR)

Jurisdiction: Federal Republic of Germany

1. Controller

Skillties GmbH
Haydnstr. 1
12203 Berlin
Germany

The controller within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR) is:

Skillties GmbH is established in Germany and operates the platform in accordance with German and European data protection law.

2. Scope of this Privacy Policy

This Privacy Policy applies to the Skillties software platform ("Platform"), including:

Skillties does not operate a separate marketing website. All publicly accessible pages are part of the Platform.

The Platform is intended exclusively for adults. Use by persons under the age of 18 is not permitted.

  • public access to the Platform without registration ("logged-out use"),
  • use of the Platform by registered users ("logged-in use"),
  • use of domain-based and claimed workspaces.

3. Structure of the Platform and Data Visibility

The Platform consists of public areas and non-public areas.

Whether personal data is visible depends on how and where it is used within the Platform.

3.1 Public areas

The following content may be publicly accessible without registration and may be indexed by search engines unless explicitly marked otherwise (e.g. legal pages):

Public visibility occurs only when users actively create or publish such content.

  • skills,
  • skill profiles,
  • public comments,
  • attribution of public content to users (real name and profile image).

3.2 Non-public areas

The following data is not publicly accessible:

  • personal skill mappings,
  • individual skill levels,
  • learning progress and history,
  • private notes,
  • workspace-internal content.

4. Registration and User Accounts

To actively use the Platform, users must register and create an account.

During registration and use of the account, Skillties processes the following personal data:

Accounts are personal and must not be shared with third parties.

  • full real name (mandatory),
  • email address,
  • authentication data (password or single sign-on identifier),
  • workspace association (if applicable),
  • the identifier at the identity provider (e.g. the Keycloak user ID) and the provider through which the sign-in took place (e.g. Microsoft Entra ID),
  • the account status (active, deletion requested, deleted).

5. Domain-Based Workspaces

5.1 Automatic workspace assignment

When a user registers with an email address associated with a specific domain (for example @siemens.com), Skillties automatically assigns the user to a shared, domain-based workspace associated with that domain.

This assignment is based solely on the email domain. Skillties does not verify organizational affiliation beyond the domain.

The purpose of this assignment is to enable domain-based collaboration and visibility of certain skill-related data among users associated with the same domain.

There is no opt-out from this assignment. If a user does not agree, registration with that email address is not possible.

5.2 Unclaimed (free) domain-based workspaces

Domain-based workspaces may initially exist without a workspace administrator ("unclaimed workspaces").

In unclaimed workspaces:

Skillties acts as the controller for the processing of personal data within unclaimed workspaces.

  • certain personal skill-related data of workspace members is visible to other members of the same workspace,
  • this may include skill mappings, enrolled skill profiles, and calculated match levels,
  • visibility is limited strictly to the workspace and is not public.

5.3 Claimed (paid) workspaces and administrator role

A domain-based workspace may be claimed by a user. Upon claiming the workspace, the claiming user becomes a workspace administrator.

Claimed workspaces may be subject to additional features, settings, or paid plans.

Workspace administrators may:

  • manage workspace members, suspend memberships (dormant) and record departures,
  • set the retention period after a departure (0 to 24 months, default six months) and define the deletion rules — where content, reports and team leads go when someone leaves,
  • import persons from the employer’s directory (Microsoft Entra ID) using the permissions of their own account,
  • configure workspace settings,
  • control the visibility of certain data within the workspace,
  • download all data of the workspace as an export (return of data under Art. 28 (3) (g) GDPR).

Workspace administrators cannot:

  • make personal data publicly accessible,
  • influence which content is public on the Platform,
  • override the Platform's public visibility rules.

Public visibility of content is determined exclusively by the Platform's functionality and by the actions of individual users when creating public content.

Depending on the contractual setup, Skillties may process certain data in claimed workspaces on behalf of the organization operating the workspace. Further details may be governed by a separate data processing agreement.

A workspace may regulate co-determination (for example by a works council) under Settings · Co-determination. Where it does, certain steps — such as suspending a membership, purging data early, extending the retention period, changing the departure process or exporting the workspace — require a record or an approval before they take effect. Without such a rule, nothing is recorded or approved implicitly.

6. User Accounts, Profiles and Identity Visibility

Skillties does not operate a publicly searchable or browsable user directory and is not designed as a social network.

Creating an account does not make a user publicly visible.

A user's real name and profile image become visible only in context, in particular when the user:

Such visibility serves solely to attribute the respective content.

Within a workspace, a user's identity and skill-related data may be visible to other workspace members, depending on the workspace type and configuration. This visibility is limited to the workspace context and does not result in public accessibility.

Use of a real name is mandatory. Display names or pseudonyms are not supported.

  • creates or edits a skill,
  • creates or edits a skill profile,
  • posts a public comment.

7. Skill-Based Calculations and Profiling

The Platform performs automated calculations based on user-provided skill data. These include, in particular:

These calculations are based on personal skill mappings and therefore constitute personal performance-related data.

They are used exclusively for purposes of orientation, comparison, and self-assessment.

Skillties does not use these calculations to make automated decisions with legal or similarly significant effects within the meaning of Article 22 GDPR.

  • average skill levels,
  • the number of required skills per skill profile,
  • match levels between users and skill profiles.

8. Invitations and Identity Providers

Users may invite other persons to join the Platform or a specific workspace.

In this context, Skillties processes:

Where available, identity providers or single sign-on solutions may be used to facilitate authentication.

If a user signs in through Microsoft Entra ID, a workspace administrator may search the employer’s directory with the permissions of their own account in order to invite persons. Skillties stores only the details of the persons actually invited; the search itself runs against the employer’s directory.

A user who hands over a skill or skill profile may name an e-mail address for the new owner. If that person is not yet on Skillties, they receive an invitation to Skillties (not to a workspace). The request expires after 14 days; the address is then no longer used.

  • the email address of the invited person,
  • information about the inviting user,
  • the invitation status,
  • for a handover: the e-mail address named for the new owner and the outcome of the request.

9. Emails and Communications

Skillties uses email communication for the following purposes:

Newsletters are sent using Brevo and are only sent on the basis of the user's consent. Users may unsubscribe at any time.

  • registration and login,
  • workspace invitations,
  • system notifications,
  • confirmation of an account deletion, including the link to cancel it,
  • requests to take over a skill or skill profile,
  • product and feature updates,
  • marketing communications (newsletter).

10. Cookies and Tracking Technologies

The Platform uses cookies and similar technologies.

Essential cookies

Session cookies are used to ensure authentication, security, and basic functionality of the Platform.

Analytics and marketing technologies (subject to consent)

With user consent, the Platform may use analytics and marketing services, including:

These technologies help analyze usage of the Platform and measure the effectiveness of communication and outreach.

  • PostHog,
  • Google Analytics,
  • Notifuse,
  • Google marketing services,
  • Meta (Facebook),
  • Microsoft Bing Ads (Universal Event Tracking).

11. Hosting and Processors

Skillties uses Google Cloud Platform with EU-only hosting.

Personal data is processed exclusively within the European Union.

Skillties works with carefully selected processors under data processing agreements in accordance with Article 28 GDPR. These may include providers for hosting, analytics, marketing, and email delivery.

To schedule a conversation with Skillties, the Platform embeds Cal.com. Name, email address, chosen time slot and related booking details are processed by Cal.com for that booking. Skillties does not store the booking content in the application in this phase.

No intentional data transfers outside the European Union take place.

12. Departure, Deletion and Anonymization

Skillties distinguishes between leaving a workspace and deleting an account. Leaving is not deleting: what a person built together with others (assessments, feedback, team time, comments) is preserved as structure, while the person’s name is removed after a retention period. Six principles govern every case below: leaving is not deleting · structure stays, the name goes · feedback belongs to the person who received it · less is deleted immediately, and nothing is kept without a rule · whoever is responsible deletes · a step can only be reversed by whoever triggered it.

12.1 Membership in a workspace

A workspace membership is in one of four states: active · dormant (access suspended, everything stays; used for parental leave, a sabbatical or a directory sync) · left (roles, groups and team memberships are ended; the name remains for the retention period) · purged (personal data in the workspace is deleted; the name is replaced by “Former member”).

A membership is changed by a workspace administrator, by the synchronisation with the employer’s directory (Microsoft Entra ID), or — in workspaces without an employer contract — by the person themselves. Only whoever suspended a membership can reactivate it; the application names the responsible contact.

The retention period after a departure is set by the workspace (0 to 24 months, default six months). After it ends, a scheduled job purges: the person’s own assessments and the feedback they received in that workspace are deleted; feedback they gave, community posts and shared team time remain without reference to their name. An administrator may purge earlier, stating a reason.

12.2 Deleting an account

Users may delete their account at any time in the account settings, provided Skillties is the controller for the account. Where an employer is the controller — sign-in through the employer’s identity provider, or membership in a workspace with a contract — the employer ends the membership and deletes the account; the application names the responsible contact in that case.

After a deletion request the account is locked immediately, also at the identity provider. Within 14 days the deletion can be cancelled through the link in the confirmation e-mail — this is the only e-mail sent in this process. After 14 days the deletion is carried out irrevocably:

Backups are overwritten in a 30-day rotation. Statutory retention obligations remain unaffected.

  • the account is deleted at the identity provider; a later sign-in with the same e-mail address creates a new, empty account,
  • name, e-mail address, profile picture, settings, own skill assessments and received feedback are deleted; the account is anonymised (“Deleted user”),
  • every workspace membership is purged as described in 12.1, regardless of the workspace’s retention period,
  • content the user left for others (feedback given, community posts, shared team time) remains without reference to the name.

12.3 Skills and skill profiles

Skills and skill profiles are shared content: once another person uses them (assigned, required by a profile, named in a team target), they are never deleted — only their maintenance changes hands. Ownership follows the place of creation: content created in a workspace belongs to that workspace and follows its deletion rules; content created outside any workspace belongs to the person.

Deleting a skill or profile that nobody uses removes it permanently, including the messages about it. Deleting one that is in use hands the maintenance over: for personal content the user may recommend a new owner by e-mail address, who has 14 days to accept; for workspace content the workspace’s process decides. If nobody takes over, the content counts as unmaintained: for 14 days the persons who used it on the cut-off date may take it over, afterwards any signed-in user. Unmaintained content remains fully usable.

The creator remains visible as the origin of the content until their account is deleted; then “Deleted user” is shown.

12.4 Workspaces

If a workspace is deleted by its administrator, its private skills and profiles, memberships, teams, feedback, requests and settings are deleted. Public skills and profiles the workspace maintained become unmaintained as described in 12.3; content maintained personally by a member stays with that member. The same applies to public content when a workspace moves to a free plan.

At the end of a contract the organisation may download a complete export of its workspace data under Settings · General; Skillties announces the export to the administrators and keeps it available for 30 days before the workspace data is deleted.

13. Rights of Data Subjects

Users have the right to:

Requests can be submitted to dataprotection@skillties.com. A copy of a user’s own data is provided on request; workspace administrators can download a complete export of their workspace in the settings.

Users also have the right to lodge a complaint with a competent supervisory authority.

  • access their personal data,
  • request rectification or erasure,
  • request restriction of processing,
  • receive their data in a portable format,
  • object to certain processing activities.

14. Changes to this Privacy Policy

This Privacy Policy may be updated from time to time.

The current version is always available on the Platform.