Privacy
Privacy Policy
This policy explains what personal data NextMove Career processes, on what legal basis, for how long, and how you can exercise the rights the GDPR gives you.
1. Who is the data controller
NextMove Career is the data controller for the personal data processed through this website and the client portal. For any question about this policy or your data, write to Thibaud.rble@gmail.com.
2. What data we collect
- Account data: name, email address, authentication identifiers (including Google or Apple sign-in identifiers).
- Project data: questionnaire answers, career history, education, target roles, motivations and any documents you upload (CV, cover letters, certificates).
- Deliverables: drafts and final documents produced for you, plus your review comments.
- Booking data: name, email and the time slot you select for an introductory call.
- Technical data: IP address, browser type, device information and security logs generated when you use the service.
We do not ask for special-category data (health, religion, political opinions, etc.). Please do not include such information in your questionnaire or uploads.
3. Why we process it and on what legal basis
- Performing our contract with you (Art. 6(1)(b) GDPR): creating your account, running your project, drafting and delivering your documents, managing bookings and support.
- Legitimate interests (Art. 6(1)(f) GDPR): securing the platform, preventing abuse, improving our service quality and keeping essential business records.
- Legal obligation (Art. 6(1)(c) GDPR): accounting and tax retention of invoices and payment records.
- Consent (Art. 6(1)(a) GDPR): optional marketing emails and any non-essential cookies. You may withdraw consent at any time.
4. Use of AI in document drafting
We use an AI drafting assistant to accelerate the first version of your documents. The information you submit is sent to that processor solely to generate your draft, is not used to train third-party models, and every output is reviewed and edited by a human consultant before it reaches you. If you prefer a fully manual process, tell us and we will disable AI assistance on your project.
5. Who has access to your data
- Our consultants, strictly on a need-to-know basis for your project.
- Hosting and database infrastructure providers operating the website and client portal.
- Our AI drafting provider, limited to generating your document drafts.
- Our transactional email provider, used to send workflow notifications.
- Our payment provider, which processes card details directly — we never see or store your card number.
We never sell your personal data. Where a processor is located outside the EEA, transfers rely on Standard Contractual Clauses or an adequacy decision.
6. How long we keep it
- Account and project data: for the life of your account, then up to 3 years after your last activity so you can return for a new project.
- Deliverables: kept in your portal until you delete them or close your account.
- Booking records: 12 months.
- Invoices and accounting records: 10 years, as required by law.
- Security logs: up to 12 months.
7. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and obtain a copy.
- Rectify inaccurate or incomplete data.
- Erase your data (right to be forgotten), subject to our legal retention duties.
- Restrict or object to processing based on legitimate interests.
- Receive your data in a portable, machine-readable format.
- Withdraw consent at any time, without affecting prior processing.
- Give instructions about the fate of your data after your death.
To exercise any of these rights, email Thibaud.rble@gmail.com. We reply within one month. You may also delete your account directly from the portal settings. If you believe your rights are not respected, you can lodge a complaint with your national supervisory authority — in France, the CNIL (www.cnil.fr).
8. Security
Access to your project is protected by authentication and row-level access controls, so only you and your assigned consultant can read your files. Data is encrypted in transit and at rest. In the event of a personal data breach likely to create a risk for you, we notify the supervisory authority within 72 hours and inform you where required.
9. Automated decision-making
We do not take decisions producing legal or similarly significant effects about you on a purely automated basis. AI is used for drafting support only, always under human review.
10. Changes to this policy
We may update this policy to reflect changes in our service or the law. The date at the top of this page always indicates the current version, and we notify account holders by email of material changes.