TODL Intelligence OÜ
BRIDGE platform (bridges.company)
Effective date: 2 October 2026
1. General provisions
1.1. This Privacy Policy (the "Policy") describes how TODL Intelligence OÜ, registry code 17518468, registered address: Harju County, Tallinn, Kesklinna District, Tuukri St 19-202, 10120, Estonia ("we", "the controller", "TODL Intelligence"), processes the personal data of individuals in connection with the BRIDGE platform and related services, websites and communication channels. TODL Intelligence OÜ is a private limited company (osaühing) entered in the Commercial Register of the Tartu County Court (Estonia).
1.2. The Policy applies to:
- the BRIDGE website and web application (bridges.company and its subdomains), including company, talent and mentor workspaces;
- contact forms, email correspondence and other communication channels;
- any other TODL Intelligence services that expressly refer to this Policy.
1.3. TODL Intelligence acts as the controller (within the meaning of Article 4(7) of Regulation (EU) 2016/679 and Article 4 of Law of the Republic of Moldova No. 195/2024) in respect of account data, platform operations, enquiries and analytics. In certain processes TODL Intelligence acts as a processor (Article 28 GDPR, Article 28 of Law No. 195/2024) or as a joint controller (Article 26 GDPR, Article 26 of Law No. 195/2024). The allocation of roles is set out in section 4.
1.4. TODL Intelligence does not sell personal data, does not provide it to third parties for their own marketing, and does not use it for advertising profiling of talents.
1.5. The terms "personal data", "processing", "controller", "processor", "data subject", "consent", "profiling" and "personal data breach" are used as defined in Article 4 of Regulation (EU) 2016/679 and Article 4 of Law No. 195/2024.
2. Applicable law and scope
2.1. TODL Intelligence OÜ is established in the Republic of Estonia, a member state of the European Union. Processing is governed by:
- Regulation (EU) 2016/679 (GDPR), directly applicable;
- the Estonian Personal Data Protection Act (isikuandmete kaitse seadus), supplementing the GDPR;
- applicable EU rules on the confidentiality of electronic communications and on the protection of information on users' devices.
2.2. For data subjects located in the Republic of Moldova, Law of the Republic of Moldova No. 195/2024 on Personal Data Protection additionally applies (published on 23.08.2024, in force since 23.08.2026, transposing the GDPR), because we offer services to data subjects in Moldova and process data related to their use of the platform (Article 3(2) of Law No. 195/2024). Law No. 284/2004 on information society services and Law No. 241/2007 on electronic communications also apply to such processing.
2.3. The requirements of the two legal frameworks largely coincide, as Law No. 195/2024 transposes the GDPR. Where a data subject is located in Moldova, we apply the provision that ensures a higher level of protection of that person's rights. The Policy does not limit any statutory rights of data subjects.
2.4. The Policy is published in Romanian, Russian and English. In the event of divergence, the Romanian version prevails for data subjects in the Republic of Moldova and the English version prevails for other data subjects.
2.5. TODL Intelligence OÜ has no establishment in the Republic of Moldova. Where processing of Moldovan data subjects' data requires a representative to be designated in writing (Article 27 of Law No. 195/2024), such a representative is appointed, and their contact details are stated in this Policy and notified to the Centre. No additional representative is required in the EU, as the controller is established in Estonia (Article 27 GDPR does not apply).
3. What data we process
3.1. Data you provide directly
| Category | Content | When collected |
|---|---|---|
| Account data | first and last name, email address, workspace role (company / talent / mentor), password or external authentication provider identifier, language and interface settings | on registration, sign-in via an external authentication service (for example Google), profile management |
| Talent profile data | professional interests and skills, education, city and country (optional), portfolio links, avatar | when completing the profile |
| Company profile data | company name, industry, contact person, business email address, description of tasks | on company registration and publication of a challenge |
| Challenge and submission content | brief text, success criteria, submission materials, files, links, comments, mentor and company scores and feedback | throughout work on a challenge |
| Contact form data | first name, last name, company, email address, message text | when sending an enquiry from the website or by email |
| Correspondence and requests | content of messages, history of data subject rights requests | when communicating with us |
3.2. Automatically generated data
Technical data required to provide and protect the service: IP address, session and authentication identifiers, device and browser type, language, request timestamps, security event and error data, and anonymised or pseudonymised usage statistics (pages, actions, session duration) collected through our own analytics service proxied through our domain.
3.3. Data provided to us by client companies
Where a company uploads materials containing third parties' personal data (for example, information about its employees, experts or candidates), the company must have a lawful basis for such disclosure. In this process TODL Intelligence acts as a processor and processes such data solely on the company's documented instructions under a data processing agreement.
3.4. Data we do not process
We do not collect or request:
- special categories of personal data (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, data concerning sex life or sexual orientation) — Article 9 GDPR, Article 9 of Law No. 195/2024;
- data on criminal convictions and offences — Article 10 GDPR, Article 10 of Law No. 195/2024;
- biometric data for personal identification;
- payment card data (where paid plans are activated, payments are handled by the payment provider; card data is not shared with us).
We do not systematically monitor users' location and do not take decisions affecting rights on the basis of solely automated processing (section 6).
4. Our roles in data processing
| Process | TODL Intelligence role | Explanation |
|---|---|---|
| Registration, account, sign-in, platform security | controller | we determine the purposes and means of processing |
| Publication of challenges, handling of talent submissions, scoring, ranking, certificates | controller (or joint controller together with the client company under a separate agreement) | we determine the platform logic; the company determines the content of its challenge and the evaluation criteria |
| Materials with third-party data uploaded by the client company | processor | we process on the company's instructions under an Article 28 agreement |
| The company's further use of a submission or talent profile (contact, selection, hiring) | client company — independent controller | the company independently determines the purposes and bases of that processing and is responsible for it |
| Support enquiries and data subject rights requests | controller | we process in order to respond |
| Analytics and product improvement | controller | we use aggregated and pseudonymised data |
A client company using talent data for selection and hiring must independently ensure compliance with applicable law, including the prohibition of discrimination, the requirements for decisions based on automated processing (Article 22 GDPR, Article 22 of Law No. 195/2024) and, where applicable, the requirements of Regulation (EU) 2024/1689 on artificial intelligence. TODL Intelligence is not an employer, an employment agency or a party to any employment relationship and does not guarantee employment.
5. Purposes and legal bases of processing
Processing is carried out only where at least one basis under Article 6 GDPR and Article 6 of Law No. 195/2024 applies.
| Purpose | Data categories | Legal basis |
|---|---|---|
| Creating an account, granting access to the workspace, performing the platform terms of use | account and profile data, submission content | performance of a contract with the data subject (Article 6(1)(b)) |
| Publishing challenges, receiving and evaluating submissions, producing rankings and certificates | talent data, submission content, scores | performance of a contract (Article 6(1)(b)); for publication of the profile and portfolio — consent (Article 6(1)(a)) |
| Matching talents with challenges, mentor support | skills, interests, activity | performance of a contract (Article 6(1)(b)); legitimate interest (Article 6(1)(f)) — improving platform relevance |
| Responding to enquiries and data subject rights requests | enquiry data | legitimate interest (Article 6(1)(f)); compliance with the controller's obligations under Articles 12–22 |
| Security, abuse prevention, protection against fraud and violations | technical data, logs | legitimate interest (Article 6(1)(f)) |
| Compliance with legal requirements, records of processing activities (Article 30), responses to lawful authority requests | data required for the relevant obligation | compliance with a legal obligation (Article 6(1)(c)) |
| Product improvement, usage analytics | aggregated and pseudonymised data | legitimate interest (Article 6(1)(f)) |
| Service notices (changes to terms, security incidents) | contact data | performance of a contract (Article 6(1)(b)); compliance with a legal obligation |
| Marketing messages (where applicable) | contact data | consent (Article 6(1)(a)), withdrawable at any time; for existing business contacts — legitimate interest, with a one-click right to object |
Consent is freely given, specific, informed and unambiguous; withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal and is as easy as giving consent (Article 7 GDPR, Article 7 of Law No. 195/2024). Where provision of data is mandatory by law or necessary to enter into a contract, we state this at the time of collection; in all other cases provision of data is voluntary.
6. Automated processing, artificial intelligence and profiling
6.1. The platform uses artificial intelligence tools to structure briefs and success criteria, match relevant challenges and talents, run preliminary technical checks on submissions and produce aggregated statistics.
6.2. Such operations may constitute profiling within the meaning of Article 4(4) GDPR and Article 4 of Law No. 195/2024. We apply the following safeguards:
- we do not take decisions producing legal effects or similarly significantly affecting a data subject based solely on automated processing (Article 22 GDPR, Article 22 of Law No. 195/2024);
- decisions on candidate selection, hiring, internship invitations or admission are taken by a human — the client company's representative; AI output is an auxiliary signal only;
- AI signals are not based on, and are not generated from, special categories of data;
- data subjects may obtain information about the logic of processing, request human intervention, express their view and contest a decision by writing to info@todl-int.com;
- where AI processing creates a high risk, we carry out a data protection impact assessment (Article 35 GDPR, Article 35 of Law No. 195/2024) and, where required, prior consultation with the supervisory authority (Article 36).
6.3. TODL Intelligence OÜ is established in the European Union and, in respect of artificial intelligence features placed on the EU market, acts as a provider within the meaning of Regulation (EU) 2024/1689 (AI Act). For AI systems used in selection and evaluation in the employment context, we apply measures consistent with the high-risk regime: a risk management system, technical documentation, automatic event logging, accuracy and cybersecurity, transparency towards users and human oversight of outputs. The allocation of obligations between us and the client company as deployer is set out in contract.
6.4. We do not use challenge or submission content to train public models, and we share such data with AI providers only as processors, under confidentiality and purpose-limitation obligations. Where a provider's terms so provide, the data is not used to train its models.
7. To whom we disclose data
7.1. Access to personal data is limited to TODL Intelligence staff who need it for their role, on the basis of a role model and the principle of least privilege.
7.2. Categories of recipients:
- the client company that published the challenge — receives the talent's submission and related materials to the extent needed for evaluation;
- mentors involved in evaluation — receive access to submission materials to the extent needed for review, under a confidentiality obligation;
- service providers (processors) — hosting and cloud infrastructure, content delivery and attack protection, authentication provider, email service, AI processing providers, analytics services, IT support and audit. Each is engaged under a contract pursuant to Article 28 GDPR and Article 28 of Law No. 195/2024 covering confidentiality, security measures, purpose limitation and sub-processor rules;
- professional advisers (lawyers, auditors) — to the extent necessary and under a duty of confidentiality;
- public authorities — only upon a lawful request or where required by law.
7.3. We do not make submission content publicly available. Materials become visible to other users only at the talent's express choice (for example, a public profile or portfolio), which can be withdrawn.
7.4. On a sale, reorganisation or transfer of the business, data may be transferred to a successor subject to compliance with this Policy; data subjects will be informed of any change of controller.
8. Transfers outside the EEA and the Republic of Moldova
8.1. Transfers of personal data within the European Economic Area take place freely (Article 1(3) GDPR; Article 44(2) of Law No. 195/2024 — for Moldova the exemption extends to EEA states).
8.2. Transfers to third countries are permitted only where there is:
- a European Commission adequacy decision, or a decision of the National Centre for Personal Data Protection of the Republic of Moldova on an adequate level of protection (Article 45 GDPR, Article 45 of Law No. 195/2024); or
- appropriate safeguards, in particular standard contractual clauses adopted by the European Commission (Decision 2021/914) or approved by the supervisory authority (Article 46 GDPR, Article 46(2)(c) of Law No. 195/2024); or
- a derogation for specific situations applicable to the circumstances (Article 49 in both instruments).
8.3. The platform infrastructure is hosted by cloud and network service providers; part of the processing may take place outside Estonia and the EEA. In such cases we base transfers on point 8.2, assess the transfer's impact on data protection, document the safeguards, and provide a copy of the relevant provisions on a data subject's request. We aim to place core processing and storage in EEA regions in order to minimise cross-border transfers.
8.4. Where no adequacy decision or appropriate safeguards exist, we inform the data subject of the possible risks of such a transfer before it takes place.
9. Retention periods
| Data category | Retention period |
|---|---|
| Account and profile data | for the lifetime of the account and 12 months after its closure or deletion |
| Submission content, scores, feedback, challenge participation history | 24 months from the last activity on the relevant challenge, unless another lawful basis requires longer retention |
| Public profile and portfolio | until consent is withdrawn or the account is deleted |
| Contact form enquiries and correspondence | 12 months from the last contact |
| Documents relating to settlements, accounting and tax records | for the period set by accounting and tax law (generally 5–7 years) |
| Data needed to establish, exercise or defend legal claims | until the relevant limitation period expires |
| Technical and security logs | 6 months; where an incident is under investigation, until the investigation concludes |
| Analytics data in aggregated or pseudonymised form | up to 14 months |
9.2. Once a period expires, data is deleted or anonymised so that it can no longer be linked back to the data subject. Where a period is determined by criteria rather than a fixed date, we provide a description of those criteria on request (Articles 13, 15 GDPR and Law No. 195/2024).
10. Security
10.1. We apply technical and organisational measures proportionate to the risks (Articles 25 and 32 GDPR, Articles 25 and 32 of Law No. 195/2024), including:
- encryption of data in transit (TLS, HSTS) and at rest;
- role-based access control, least privilege and multi-factor authentication for administrative access;
- access logging on production systems and security event monitoring;
- secrets and key management, regular backups and restoration testing;
- perimeter protection, traffic filtering and protection against automated attacks, request rate limiting;
- staff training and confidentiality obligations;
- regular assessment and testing of the effectiveness of security measures;
- data protection by design and by default (Article 25), including data minimisation.
10.2. No system is perfectly secure. We cannot guarantee the security of data transmitted over open channels outside our control, but we take all reasonable measures to protect data and reduce risk.
11. Personal data breaches
11.1. In the event of a personal data breach we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals (Article 33 GDPR; Article 33 of Law No. 195/2024 — for processing falling under Moldovan law, notification is made to the National Centre for Personal Data Protection).
11.2. Where a breach is likely to result in a high risk to the rights and freedoms of individuals, we inform the affected data subjects without undue delay in clear and plain language, describing the nature of the breach and the measures taken (Article 34 GDPR; Article 34 of Law No. 195/2024).
11.3. All incidents are documented, including the facts, effects and remedial action taken. Processors must notify us of any breach without delay.
12. Your rights
Under the GDPR and Law No. 195/2024 you have the right:
- to information — to know who the controller is, what data is processed, for what purpose, on what basis and to whom it is disclosed (Articles 13, 14);
- of access — to obtain confirmation of processing and access to your data (Article 15);
- to rectification of inaccurate or incomplete data (Article 16);
- to erasure ("right to be forgotten") where lawful grounds apply (Article 17);
- to restriction of processing (Article 18);
- to data portability — to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller where technically feasible (Article 20);
- to object to processing based on legitimate interests or a public interest task, and to direct marketing at any time and without giving reasons (Article 21);
- not to be subject to a decision based solely on automated processing, including profiling, with the right to human intervention, to express your view and to contest the decision (Article 22);
- to withdraw consent at any time, without affecting the lawfulness of prior processing (Article 7);
- to lodge a complaint with a supervisory authority, to seek a judicial remedy, to obtain compensation and to be represented by an authorised body (Articles 72, 74, 75, 76 of Law No. 195/2024; Articles 77, 78, 79, 80, 82 GDPR).
13. How to exercise your rights
13.1. Send your request to info@todl-int.com, stating your name, information identifying you as a data subject (for example, the email address of your account), the substance of the request and your preferred means of reply.
13.2. We respond without undue delay and in any event within one month of receiving the request. The period may be extended by a further two months taking into account the complexity and number of requests; we inform you of any extension and the reasons within the first month (Article 12 GDPR; Article 12(3) of Law No. 195/2024).
13.3. Requests are handled free of charge. In cases expressly provided by law (manifestly unfounded or excessive requests) we may refuse to act or charge a reasonable fee, giving reasons and explaining your right to complain to a supervisory authority and to seek a judicial remedy.
13.4. Where we cannot identify you, we may request additional information needed to verify your identity and to prevent disclosure of data to third parties.
13.5. Supervisory authorities:
- Estonia (lead authority): Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn; phone +372 627 4135; email info@aki.ee; website aki.ee;
- Republic of Moldova: National Centre for Personal Data Protection (CNPDCP), MD-2004, Chișinău, 48 Serghei Lazo St; phone (022) 820 801; email centru@datepersonale.md; website datepersonale.md.
You may lodge a complaint with the supervisory authority in your habitual residence, place of work or the place of the alleged infringement.
14. Cookies and similar technologies
14.1. We use:
- strictly necessary technologies — authentication and session maintenance, load balancing, protection against automated attacks and fraud, storage of your selected language. These technologies are required for the service to function;
- functional — storage of your interface preferences;
- analytics (statistical) — measurement of platform usage in aggregated and pseudonymised form through our own analytics service proxied through our domain.
14.2. We do not use third-party advertising trackers and do not share behavioural data with advertising networks.
14.3. Non-essential technologies are used on the basis of your consent, which can be given, refused or withdrawn at any time through the consent management banner and in your browser settings. Disabling strictly necessary technologies may make the platform unusable.
14.4. Device-dependent technologies (local storage, session identifiers) are managed on the same bases as cookies.
15. Children and minors
15.1. The platform is intended for persons aged 18 or over. Registration of minors is not permitted, as the service relates to professional activity and participation in corporate processes. This threshold is higher than the minimum age of consent for information society services set by applicable law (14 years — Article 8 of Law No. 195/2024).
15.2. Age is confirmed by self-declaration at registration. If we learn that data of a person under 18 has been processed without a lawful basis, we delete that data without undue delay.
15.3. If you are a legal representative and believe a child's data has been processed unlawfully, send a request to info@todl-int.com.
16. Data you must not upload
16.1. Users must not upload to the platform special categories of personal data, data on criminal convictions and offences, third parties' biometric data, or third parties' personal data without a lawful basis.
16.2. Where such data is identified, we may restrict or terminate account access, remove the relevant content and inform affected data subjects where required by law.
17. Changes to the Policy
17.1. We may update the Policy. The current version is always available at bridges.company/privacy with the date of the last update.
17.2. We notify users of material changes affecting data subjects' rights through the service interface or by email within a reasonable period in advance. Continued use of the platform after changes take effect means acceptance of the updated Policy to the extent such acceptance is required; statutory rights are not limited.
18. Contact
Data controller:
TODL Intelligence OÜRegistry code: 17518468
Registered address: Harju County, Tallinn, Kesklinna District, Tuukri St 19-202, 10120, Estonia
Email:info@todl-int.com Contact point for data protection matters, including the exercise of data subject rights: info@todl-int.com