Version 2.2, release candidate dated 4 October 2026. This version takes effect when this update is published on the Vercel-hosted reqruitz.com site. It retains immediate employer marketing consent from the optional checkbox and adds the narrow candidate-marketing provider transition and consent-first GA4 disclosure. This notice does not itself activate either service.
1. Scope
This notice explains how Reqruitz Oy ("reQruitz", "we") processes personal data relating to visitors of reqruitz.com, client and employer contacts, people who contact us about recruitment services, job applicants, sourced and referred candidates, talent-pool and Connect participants, and people who separately choose future communications. The Teamtailor career site also has a candidate-specific privacy layer and a separate Cookie Policy.
2. Data we receive and sources
We receive data directly from you through website forms, applications, interviews, messages, meetings, consent choices and other interactions. For sourced or referred candidates, we may receive professional data from publicly available professional sources, a referrer, a recruiting client, Teamtailor or another recruitment source. We tell sourced or referred candidates about the processing within the period required by Article 14 GDPR, normally at first contact and no later than one month after obtaining the data, unless a lawful exception applies.
Depending on the relationship, data may include identity and contact details; employer, role and company details; enquiry and correspondence content; consent and preference records; application, CV, work-history, education, skills, language, availability and interview data; assessment or reference data where lawfully collected; public professional-profile data; source and referral details; recruitment notes and status; technical request, device, browser and approximate-location data; consent choices; and consent-gated analytics identifiers and events.
Please do not provide special-category data, criminal-conviction data, national identification numbers or other unnecessary sensitive information unless we specifically and lawfully request it. Recruitment data is limited to what is necessary for the role and process. Where the Finnish Act on the Protection of Privacy in Working Life applies, its necessity and direct-collection rules also apply.
3. Purposes and legal bases
Website delivery, security and essential consent storage
Purpose: Deliver the site, remember privacy choices, prevent misuse and diagnose failures
Legal basis: GDPR Article 6(1)(f), our legitimate interest in a secure and functional service; terminal access limited to what is strictly necessary
Consent-gated optional website measurement
Purpose: Understand aggregated use and real-user performance and improve the website
Legal basis: GDPR Article 6(1)(a), consent, together with Finnish cookie-consent requirements. No optional measurement runs unless the named service is enabled and the visitor has consented.
Enquiries from an individual seeking services
Purpose: Respond, discuss the need and prepare or perform requested services
Legal basis: Article 6(1)(b), steps requested before a contract or performance of a contract
Employer or client representative enquiries
Purpose: Respond, manage the business relationship and deliver recruitment services
Legal basis: Article 6(1)(f), our and the represented organisation's legitimate interests in handling the enquiry and relationship
Recruitment applications
Purpose: Receive, assess and administer the requested recruitment process
Legal basis: Normally Article 6(1)(f), legitimate interests of the candidate, reQruitz and hiring client in a fair and effective recruitment process; Article 6(1)(b) only where reQruitz itself is the prospective contracting party
Sourced and referred candidates
Purpose: Identify and contact potentially relevant professionals and evaluate interest
Legal basis: Article 6(1)(f), subject to a documented legitimate-interest assessment and timely Article 14 notice
Client reporting and candidate sharing
Purpose: Present relevant candidates and manage an assignment
Legal basis: Article 6(1)(f), limited to the relevant hiring client and assignment
Talent pool, Connect and job alerts
Purpose: Retain a profile and send separately requested opportunity updates
Legal basis: Article 6(1)(a), specific consent
Candidate career-development communications
Purpose: Send separately requested information about courses, CV, LinkedIn-profile or interview support
Legal basis: Article 6(1)(a), separate specific consent; candidate marketing through Resend only after verified cutover and purpose-specific permission
Optional B2B email marketing
Purpose: Send occasional recruitment insights, practical guidance, reQruitz service updates, guides, lead magnets and event or webinar invitations
Legal basis: Article 6(1)(a), consent; used only after separate activation and the person's explicit employer-marketing choice
AI-assisted recruitment functions
Purpose: Support human screening, summarisation, suggestions, drafting, translation, meeting notes, skill extraction and discrimination checks
Legal basis: The same Article 6 basis as the underlying recruitment activity; no solely automated final decision
Legal duties, rights requests and claims
Purpose: Meet legal duties, respond to rights, establish or defend claims
Legal basis: Article 6(1)(c) where a legal duty applies and Article 6(1)(f) for legal claims and accountability
Where legitimate interest is used, we assess necessity, reasonable expectations, data sensitivity, safeguards and the effect on the person. You may object on grounds relating to your situation. Direct marketing may always be objected to without giving reasons.
4. Client and employer enquiries
When the employer contact form is enabled on the published website, Vercel receives the HTTPS request and runs the application endpoint, Cloudflare Turnstile processes the minimum browser and request signals needed to prevent automated misuse, and the isolated Neon application database stores the controlled enquiry, privacy-notice acknowledgement, any separate consent evidence and the delivery ledger. The form rejects candidate fields, files, answers and Teamtailor identifiers.
After the separately gated delivery services are activated, Resend may send the requested service acknowledgement and a notification to an authorised reQruitz owner, and Pipedrive may receive the relevant organisation, contact, lead and follow-up information. Until those services pass their activation gates, the committed enquiry remains recoverable without those external effects.
Employer marketing is an optional, unchecked and separate choice. Selecting the checkbox records consent immediately. No separate email confirmation is required. After the marketing delivery services pass their activation gates, an eligible subscriber receives a thank-you welcome email with useful hiring insights, blog articles and current open positions, followed by relevant employer marketing. The exact statement, language, source, version and event times are retained as evidence. Withdrawal, complaint, permanent delivery failure or a shared channel block stops future messages. Service handling does not depend on a marketing choice.
5. Candidate data
Applications are completed in Teamtailor for the selected vacancy and recruitment process. Application fields, CVs, phone numbers, cover letters, profile links, answers, Teamtailor identifiers, recruitment stages and application metadata do not enter the reqruitz.com application database, Payload CMS, Resend, Pipedrive, website analytics or ordinary website logs.
If a candidate separately chooses relevant reQruitz marketing, an isolated reQruitz-managed Cloudflare workflow retains the minimised permission and suppression evidence. Only the separately permitted marketing email address and optional name may be sent to Resend for approved marketing delivery after verified cutover. This candidate route remains separate from employer enquiries, their Neon ledger and Pipedrive. Application data is not copied into it, and the marketing identity is never sent to Payload, website analytics or ordinary logs. Withdrawal, complaint, permanent bounce or a shared channel block stops future marketing.
Brevo outbound candidate messages are disabled, and Brevo will not be used for future delivery. Historical permission, suppression and delivery evidence is retained only as needed for reconciliation, retention and rollback checks. The new Resend candidate delivery is not activated merely by this notice change. A communications failure, delay or withdrawal does not affect an application.
6. Hiring clients and role allocation
Reqruitz Oy is controller for its own sourcing, recruitment administration, relationship management, security and legal obligations. A hiring client normally acts as a separate controller when it decides why and how it evaluates candidates for its role. reQruitz may act as that client's processor for a specifically documented activity only where the contract and actual instructions establish that role. Before data is shared, the candidate should be told the hiring client's identity or category and the relevant recruitment context. The final controller allocation must be verified against each client agreement before publication of any categorical claim.
7. Teamtailor and AI assistance
Teamtailor provides the candidate-management platform and processes customer data for reQruitz under its data-processing terms. The reQruitz account is hosted in Teamtailor's Europe region. Teamtailor's current official subprocessor list includes EEA hosting and service providers and conditional services that may involve restricted transfers. Applicable safeguards may include adequacy decisions, the EU-US Data Privacy Framework and the European Commission's 2021 Standard Contractual Clauses. The exact optional services enabled for the account must be kept current in the processor register.
Enabled Teamtailor Co-pilot capabilities may assist human users with screening support, candidate suggestions, CV summaries and timelines, meeting insights, drafting and translation, CV skill extraction and discrimination detection. Outputs may be incomplete or inaccurate and require human review. No client or candidate decision is made solely by automation or AI, and human reviewers make final recruitment decisions. If this operating fact changes, the notice and any required impact assessment must be updated before use.
8. Recipients, processors and international transfers
Access is limited to authorised reQruitz personnel and, where relevant, the hiring client and its authorised participants. Teamtailor processes applications and recruitment records. Vercel hosts the website and application endpoints. Neon stores the isolated employer-enquiry database and editorial data. Vercel Blob may store public website media. Cloudflare provides Turnstile abuse prevention and the isolated candidate-communications and shared-suppression boundary. Adobe supplies the website font. Brevo outbound candidate messages are disabled; its historical evidence may be retained for reconciliation and retention. Resend may receive only a separately permitted candidate-marketing email address and optional name through the isolated candidate workflow after verified cutover, never application data. Resend and Pipedrive process employer service or marketing data only after their respective activation gates. Optional Vercel Web Analytics and Speed Insights process minimised website measurement only when enabled and consented to. Google Analytics 4 may process minimised website measurement only when enabled in the current service inventory and after prior analytics consent. No Google request is sent before consent. The existing GA4 settings retain event data for two months and user data for fourteen months, with user retention reset on new activity. These settings govern measurement after activation and consent. Google Ads remains disabled.
Some providers and subprocessors may process data outside the EEA. Vercel identifies primary processing facilities in the United States and contractual transfer mechanisms in its DPA. Resend states that message content, logs, webhook payloads and account records are stored in the United States even when Ireland is selected for sending, and its DPA incorporates the applicable EU Standard Contractual Clauses. Before a gated provider receives production personal data, reQruitz records the applicable agreement, subprocessors, processing locations, transfer mechanism, retention and account settings. An unresolved assessment keeps that provider disabled.
Employer and candidate permissions remain purpose-separated. A complaint, permanent bounce, invalid address or provider-level block is honoured as a shared email-channel suppression without copying candidate profiles or application data into the employer system.
9. Retention and deletion
We retain personal data only for the stated purpose, then delete or irreversibly anonymise it unless a statutory duty or scoped legal hold requires longer retention.
Enquiry that does not lead to a client relationship
Operational rule: 12 months after the last meaningful contact
Necessary active-client operational records
Operational rule: Six years after the assignment or client relationship ends, limited to records needed for accountability or claims
Accounting material
Operational rule: Six years for vouchers and transaction correspondence, and ten years for financial statements, ledgers and other material covered by Chapter 2, Section 10 of the Finnish Accounting Act
Job application
Operational rule: 24 months after the recruitment ends or the last meaningful recruitment action
Sourced or referred person who does not enter a process
Operational rule: Six months after the first notice or contact
Talent pool, Connect, job alert or candidate career-communications choice
Operational rule: Until withdrawal or 24 months of inactivity, after which the choice is renewed or the data is deleted within 30 days
Employer marketing permission
Operational rule: Until withdrawal or 24 months of inactivity, after which permission is renewed or marketing stops
Consent evidence and rights-request records
Operational rule: Three years after withdrawal, expiry, last use or closure of the request
Minimised suppression record
Operational rule: Six years with an annual necessity review, or until a valid replacement permission can lawfully clear the relevant purpose-specific block. Complaint and provider-level blocks are not cleared automatically.
Technical queue content
Operational rule: No more than 30 days
Operational and delivery logs
Operational rule: 90 days, unless a documented security incident or legal hold requires a scoped extension
Encrypted rolling backups
Operational rule: 90 days through the normal rotation cycle
Provider-side retention is verified before activation and handled in deletion procedures. Pending actions are cancelled when withdrawal, a rights-request lock or a shared channel block applies. An uncertain provider result is reconciled and is not sent again blindly.
10. Security
Controls include encrypted transport, encrypted sensitive application fields, separately keyed lookup identifiers, least-privilege service identities, strict request schemas and size limits, timestamped signatures, replay protection, idempotency, disabled-by-default external effects, durable reconciliation, structured logs without direct identifiers, scheduled retention and verified deletion. Candidate submissions remain in Teamtailor and are excluded from the website form and email stack.
11. Your rights
Depending on the circumstances, you may request access to and a copy of your data; correction; deletion; restriction; portability of data processed by automated means on consent or contract; and information about recipients. You may object to legitimate-interest processing on grounds relating to your situation and may object to direct marketing at any time. You may withdraw consent at any time without affecting processing performed before withdrawal.
Send a request to Kasper.Kullberg@reqruitz.com. We may ask for information necessary to verify identity. We normally respond within one month, subject to the extensions permitted by law. You may complain to Finland's Office of the Data Protection Ombudsman at tietosuoja.fi. We encourage you to contact us first so that we can address the issue.
12. Children and minors
The website and client services are not directed to children. Recruitment may exceptionally concern a minor who is legally eligible for the role. In that case, we use age-appropriate information, collect only necessary data and apply any consent, guardian or employment-law requirements relevant to the person's age and circumstances. Optional marketing and career-development communications should not be offered to children without a separately verified lawful design.
13. Cookies and similar technology
The separate Cookie Policy lists the technology and current optional-service inventory for reqruitz.com. Optional website measurement is blocked before consent and remains off when the service is disabled. Teamtailor controls the cookies and consent interface on its separate career service.
14. Changes
We update this notice when the processing, systems, providers or law changes. The version, effective date and material change are stated here. A new or materially different purpose is not activated merely by editing this notice; the legal basis, provider assessment, system settings and any required choice must be ready first.
Primary sources
Reviewed 1 September 2026: EU General Data Protection Regulation, Finnish Data Protection Act, Office of the Data Protection Ombudsman, Vercel DPA, Neon DPA, Cloudflare Turnstile Privacy Addendum, Resend GDPR information, Resend DPA and the current Teamtailor privacy documents linked from its candidate service.