Version 2026-09-13.1 — 13 September 2026. Effective upon publication.
Controller and contact
PIMPMYBOSS, a French single-member simplified joint-stock company with EUR 1,000 share capital, Toulouse register number 929 062 321, 38 boulevard d'Arcole, 31000 Toulouse, France, determines the purposes and means of processing. Contact admin@pimpmyboss.com or write to that address, marked PIMPMYBOSS — Data Protection. This contact is not represented as a formally appointed data protection officer.
Data and sources
The service processes account and authentication information, including email, supplied identity information and language. Passwords are handled by the authentication service and are not displayed to the provider in plaintext. It also processes structured preferences and behaviours, calculated components, relationship evaluations, four quality indicators, lived scores, closed pulse and situation answers, and closed feedback. Relationship context includes the manager, company, country, period and contract type supplied. Hosting and authentication providers process technical information such as IP addresses and sign-in events according to their configuration.
Some manager information is supplied by someone reporting a professional relationship, before that manager registers or claims a profile. Perceptions describe reported experiences rather than established facts about a person's worth. Company information comes from the service's reference sources and structured relationship information.
Mandatory fields are needed for the relevant journey; without them, matching or calculation may be impossible. Pulse and result feedback are optional. A photo selected for a personal card is processed locally in the browser, not uploaded by that function, and may be included in the exported file at your request. Do not enter health, union-membership, opinion or other sensitive information in identification fields. The situational safety choice directs users to appropriate support; it is not intended to build an allegation or diagnosis record.
Purposes and legal bases
Account management, authentication and requested personal profiles and results rely on contract performance under GDPR Article 6(1)(b), to the extent objectively necessary. Identifying relationships and processing information about unregistered managers rely on the provider's legitimate interest in enabling protected understanding of professional relationships under Article 6(1)(f), subject to documented balancing. Protected collective aggregation also relies on legitimate interests, safeguards, information and applicable objection rights. Optional closed feedback serves the legitimate interest in service quality, with minimisation and objection rights. Security and abuse prevention rely on legitimate interests or a specific legal obligation where applicable. Data-rights handling relies on Article 6(1)(c). Ordinary support relies on contract performance or legitimate interests depending on the request.
Consent is not used as a blanket authorisation. Any future optional operation requiring consent will have a separate choice. The described launch does not sell personal data, provide targeted advertising, operate a coaching marketplace or grant HR access to individual answers.
Visibility and safeguards
Evaluators see their own history. Managers do not receive evaluator names, individual answers or dates, or exact counts. Collective publication requires at least three evaluators and other safeguards. Collective percentiles require at least five eligible contributions under the applicable rules. Simulation-based reference ranges are different from collective statistics.
The pulse uses eligible observations and protected consolidation. Its six-week window concerns current signals, not deletion of personal history. Future-situation preparation stays private. Publishable collective signals are identical for the manager and authorised contributors; personal analyses are not shared.
Identifiers and encryption are safeguards and may constitute pseudonymisation where relinking remains possible; they are not automatically legal anonymisation. No public manager ranking is published. Internal access is restricted to authorised people for necessary operations. Legally binding authority requests are assessed and limited; they do not create a right for managers or employers to access evaluator identities.
Retention policy
| Data | Target retention rule |
|---|---|
| Account, profile and useful personal history | During active use, then no more than three years from the user's last meaningful activity; provider emails or background jobs do not reset this period |
| Accepted account closure | Removal from active use and erasure within the applicable rights-request period; operational target of thirty days, except a justified legal exception |
| Unfinished questionnaire or situation drafts | No more than thirty days after the last draft activity, or an earlier server deadline |
| Routine connection and abuse-prevention logs | Up to six months, except isolated evidence needed for a specific incident investigation |
| Necessary administrative-access audit logs | Up to twelve months, restricted to their separate security purpose |
| Ordinary support | Three years after case closure, with minimised attachments and content |
| Minimal rights-request or contractual-acceptance evidence | Up to five years after case or contract closure, separately restricted to proof and legal defence; this is a policy choice requiring justification, not a universal GDPR requirement |
| Genuinely anonymous statistics | Up to five years under the management policy; data still relating to an identifiable manager remain personal data |
A specific obligation or dispute may justify restricted preservation of relevant evidence, not unlimited active retention of an entire account. The database has a window of seven daily backups. Backups must not extend active processing; deletions must be reapplied after restoration before reopening the service. The exact Hostinger backup retention remains to be confirmed before production.
Account erasure destroys the evaluator's self-assessments and profile. Relational information may remain anonymous with respect to the evaluator only if reasonable identification and linkage possibilities, including combination with other data, have been irreversibly removed. Information still identifying a manager remains subject to that person's rights and retention rules. Without demonstrated anonymisation, erase it unless a specific legal duty justifies preservation.
Providers and transfers
Hostinger hosts the website in France, with backups in Lithuania, and sends transactional emails through its SMTP service. Supabase provides the database and authentication. This project's primary database is in Ireland (eu-west-1), with the last seven daily database backups available. Database backups do not include objects held by the file-storage service.
Data are limited to each provider's task: technical website-delivery data, application and authentication data, and the recipient address and transactional email content. Legal emails do not contain individual scores or evaluator identities.
European server locations do not guarantee exclusively European access. Supabase publishes a data-processing agreement with Supabase Pte. Ltd. in Singapore, including standard contractual clauses for relevant transfers. Hostinger also publishes its data-processing agreement and subprocessors. See https://supabase.com/legal/customer-resources/data-processing-addendum and https://www.hostinger.com/legal/dpa. Request information and applicable safeguards at admin@pimpmyboss.com. Verification of the applicable contracts, access locations and additional measures remains a production-launch requirement.
Profiling and decisions
Automated server-side calculations compare structured preferences and behaviours with theoretical references to produce profile shares. Compatibility assesses gaps across ten pairs. Situation insights apply rules and contextualised wording. These operations may constitute profiling even without a legal decision.
PIMPmyBOSS does not make hiring, pay, promotion, disciplinary or dismissal decisions. Results are not designed as their sole basis. You may request an explanation, challenge factual errors and ask for human consideration of a difficulty. This does not guarantee that a subjective perception will change or that its author will be revealed.
Your rights
You may request access, rectification, erasure or restriction under the GDPR, and portability of information you provided where the conditions apply. You may object on grounds relating to your particular situation to legitimate-interest processing. Where consent applies, you may withdraw it for the future without affecting prior lawful processing. French-law instructions concerning data after death are also available where applicable.
Use admin@pimpmyboss.com, preferably from your account email, or the postal address. Identity documents are not routinely required; proportionate evidence may be requested where reasonable doubt exists. The normal response period is one month from receipt. A reasoned extension of up to two further months may apply under GDPR conditions, with notice during the first month. Refusals explain reasons and remedies.
Unregistered managers may exercise rights without claiming a profile or paying. Requests protect contributors' rights. You may complain to the CNIL at www.cnil.fr or the competent authority and seek judicial remedies.
Unregistered people and updates
Information about a manager may come from someone declaring a professional relationship, even before the manager registers. PIMPmyBOSS does not collect a manager's email address or other personal contact details for the purpose of sending evaluation notifications, and does not send individual notices of evaluations. Managers may discover eligible aggregate results after registering and completing a controlled claim of their profile; individual contributions are never disclosed.
This website provides public information on the processing, its sources, purposes, recipients, retention periods and data-subject rights. Where providing an individual notice under Article 14 GDPR would require collecting additional contact details or undermine evaluator confidentiality, PIMPmyBOSS assesses and documents whether the exception under Article 14(5)(b) applies, taking proportionality and alternative transparency safeguards into account. Publishing this notice does not, by itself, establish that the exception applies.
An unregistered manager can request access, correction or erasure where applicable, and object to processing, without creating an account, by contacting admin@pimpmyboss.com or writing to the controller's postal address. Identity and entitlement are checked proportionately. Exercising these rights never exposes evaluators' identities, individual answers or identifying details.
Material policy changes are communicated appropriately. An incompatible new purpose cannot be authorised by simply editing this text. The provider retains actual publication dates and applicable versions.