Privacy Notice

1. Scope

This notice explains how Reqruitz Oy ("reQruitz", "we") processes personal data relating to visitors of reqruitz.com, client and employer contacts, people who contact us about recruitment services, job applicants, sourced and referred candidates, talent-pool and Connect participants, and people who separately choose future communications. The Teamtailor career site also has a candidate-specific privacy layer and a separate Cookie Policy.

2. Data we receive and sources

We receive data directly from you through website forms, applications, interviews, messages, meetings, consent choices and other interactions. For sourced or referred candidates, we may receive professional data from publicly available professional sources, a referrer, a recruiting client, Teamtailor or another recruitment source. We tell sourced or referred candidates about the processing within the period required by Article 14 GDPR, normally at first contact and no later than one month after obtaining the data, unless a lawful exception applies.

Depending on the relationship, data may include identity and contact details; employer, role and company details; enquiry and correspondence content; consent and preference records; application, CV, work-history, education, skills, language, availability and interview data; assessment or reference data where lawfully collected; public professional-profile data; source and referral details; recruitment notes and status; technical request, device, browser and approximate-location data; consent choices; and consent-gated analytics identifiers and events.

Please do not provide special-category data, criminal-conviction data, national identification numbers or other unnecessary sensitive information unless we specifically and lawfully request it. Recruitment data is limited to what is necessary for the role and process. Where the Finnish Act on the Protection of Privacy in Working Life applies, its necessity and direct-collection rules also apply.

3. Purposes and legal bases

Website delivery, security and essential consent storage

Purpose: Deliver the site, remember privacy choices, prevent misuse and diagnose failures
Proposed legal basis: GDPR Article 6(1)(f), our legitimate interest in a secure and functional service; terminal access limited to what is strictly necessary

Consent-gated GA4 analytics

Purpose: Understand aggregated use and improve the site
Proposed legal basis: GDPR Article 6(1)(a), consent, together with Finnish cookie consent requirements

Enquiries from an individual seeking services

Purpose: Respond, discuss the need and prepare or perform requested services
Proposed legal basis: Article 6(1)(b), steps requested before a contract or performance of a contract

Employer or client representative enquiries

Purpose: Respond, manage the business relationship and deliver recruitment services
Proposed legal basis: Article 6(1)(f), our and the represented organisation's legitimate interests in handling the enquiry and relationship

Recruitment applications

Purpose: Receive, assess and administer the requested recruitment process
Proposed legal basis: Normally Article 6(1)(f), legitimate interests of the candidate, reQruitz and hiring client in a fair and effective recruitment process; Article 6(1)(b) only where reQruitz itself is the prospective contracting party

Sourced and referred candidates

Purpose: Identify and contact potentially relevant professionals and evaluate interest
Proposed legal basis: Article 6(1)(f), subject to a documented legitimate-interest assessment and timely Article 14 notice

Client reporting and candidate sharing

Purpose: Present relevant candidates and manage an assignment
Proposed legal basis: Article 6(1)(f), limited to the relevant hiring client and assignment

Talent pool, Connect and job alerts

Purpose: Retain a profile and send separately requested opportunity updates
Proposed legal basis: Article 6(1)(a), specific consent

Candidate career-development communications

Purpose: Send separately requested information about courses, CV, LinkedIn-profile or interview support
Proposed legal basis: Article 6(1)(a), separate specific consent; currently inactive

Optional B2B email marketing

Purpose: Send occasional recruitment insights, practical guidance, reQruitz service updates, guides, lead magnets and event or webinar invitations
Proposed legal basis: Article 6(1)(a), consent for the intended reQruitz operating model; currently inactive

AI-assisted recruitment functions

Purpose: Support human screening, summarisation, suggestions, drafting, translation, meeting notes, skill extraction and discrimination checks
Proposed legal basis: The same Article 6 basis as the underlying recruitment activity; no solely automated final decision

Legal duties, rights requests and claims

Purpose: Meet legal duties, respond to rights, establish or defend claims
Proposed legal basis: Article 6(1)(c) where a legal duty applies and Article 6(1)(f) for legal claims and accountability

Where legitimate interest is used, we assess necessity, reasonable expectations, data sensitivity, safeguards and the effect on the person. You may object on grounds relating to your situation. Direct marketing may always be objected to without giving reasons.

4. Client and employer enquiries

The client Contact Form is used to respond to an enquiry, discuss a recruitment need and prepare or perform requested recruitment services. Webflow receives the form submission. When the production relay is active, Webflow sends the exact signed submission to a reQruitz-controlled Cloudflare Worker. The relay validates the site, form, language, audience and expected fields; stores the permitted enquiry fields in encrypted form in Cloudflare D1; uses Cloudflare Queue for controlled processing; and keeps an audit trail and retention state. Acknowledging this notice is not consent.

For service-enquiry handling, the relay may create or update the relevant organisation and contact in Pipedrive, create a HOT lead and follow-up activity, send a receipt acknowledgement through Brevo, and notify the authorised reQruitz owner. These service actions do not depend on the optional marketing choice. After an auditable transfer, the relay can coordinate deletion of the known Webflow submission under the retention rule below.

The separate marketing checkbox is optional and unchecked by default. Selecting it is the single affirmative action that records employer-marketing permission; no second confirmation is required and no confirmation email is sent. The exact statement, version, time, language and source form are retained as evidence. When employer-marketing delivery is active and no shared email block applies, the minimum contact may be mirrored to the separate Brevo employer list. The first email sent under this choice is employer marketing, not a confirmation request. Employer marketing covers reQruitz hiring insights, recruitment updates and relevant employer services. It excludes candidate communications, job-application messages, third-party advertising, LinkedIn outreach, cold email, phone calls and SMS. Every employer-marketing message explains why it was sent and provides an unsubscribe route.

5. Candidate processing

A job application is processed in Teamtailor for the selected vacancy and recruitment process. Application fields, CVs, phone numbers, cover letters, LinkedIn URLs, answers, Teamtailor identifiers, recruitment stages and application metadata are not copied to the candidate-communications system.

If the separate optional candidate-communications choice is missing or not selected, no candidate-marketing permission or Brevo candidate contact is created and the application continues normally. After a successful application, an affirmative choice may place a separate minimized permission event on a Cloudflare Queue. The event contains only email address, optional first name, language, the exact choice statement and version, time, and a non-identifying permission reference. A separate reQruitz-controlled Cloudflare Worker stores the delivery fields encrypted in D1 and may use Brevo to send candidate welcome messages, verified new-role alerts and owner-reviewed monthly role and career-content editions.

New-role alerts are eligible only after the role is publicly available and its English, Finnish and Swedish public URLs have been independently verified. The first three monthly editions are held for owner review, and owner review is required by default for later editions. Candidate permission never authorises employer-service marketing or a Pipedrive record. A failed, delayed or withdrawn candidate-communications choice does not affect the application.

6. Hiring clients and role allocation

Reqruitz Oy is controller for its own sourcing, recruitment administration, relationship management, security and legal obligations. A hiring client normally acts as a separate controller when it decides why and how it evaluates candidates for its role. reQruitz may act as that client's processor for a specifically documented activity only where the contract and actual instructions establish that role. Before data is shared, the candidate should be told the hiring client's identity or category and the relevant recruitment context. The final controller allocation must be verified against each client agreement before publication of any categorical claim.

7. Teamtailor and AI assistance

Teamtailor provides the candidate-management platform and processes customer data for reQruitz under its data-processing terms. The reQruitz account is hosted in Teamtailor's Europe region. Teamtailor's current official subprocessor list includes EEA hosting and service providers and conditional services that may involve restricted transfers. Applicable safeguards may include adequacy decisions, the EU-US Data Privacy Framework and the European Commission's 2021 Standard Contractual Clauses. The exact optional services enabled for the account must be kept current in the processor register.

Enabled Teamtailor Co-pilot capabilities may assist human users with screening support, candidate suggestions, CV summaries and timelines, meeting insights, drafting and translation, CV skill extraction and discrimination detection. Outputs may be incomplete or inaccurate and require human review. No client or candidate decision is made solely by automation or AI, and human reviewers make final recruitment decisions. If this operating fact changes, the notice and any required impact assessment must be updated before use.

8. Recipients, processors and transfers

Data may be made available only as necessary to authorised reQruitz personnel; the relevant hiring client and authorised recruitment participants; Teamtailor for applications and candidate management; Webflow for website delivery and form receipt; Cloudflare for the signed relay, D1 storage, Queue processing, scheduled retention and security; Pipedrive for employer/client enquiry and follow-up handling; Brevo for transactional acknowledgements, the internal owner notification containing the permitted enquiry fields needed for follow-up, employer-list mirroring, and separately consented employer or candidate email delivery; Google Analytics after analytics consent; professional advisers, authorities or courts where legally required; and the providers' authorised subprocessors.

Employer/client and candidate permission ledgers remain separate. Under the accepted single Brevo Free-account boundary, an unsubscribe, complaint, hard bounce, invalid address or provider block is applied conservatively as a shared email-channel block across both email tracks. A direct withdrawal remains recorded under its own purpose and cannot override the shared block.

Before restricted processing or transfer is activated, reQruitz verifies the applicable provider terms, data-processing agreement, subprocessor list, processing location, transfer mechanism and account configuration. Provider and account facts are maintained in the processor register and updated when they change.

9. Retention and deletion

We retain data only as long as necessary for the stated purpose, then delete or irreversibly anonymise it unless a legal hold or statutory obligation applies.

Unconverted client enquiry

Operational retention rule: 12 months from the last meaningful interaction

Active client operational record

Operational retention rule: Six years after the assignment or client relationship ends, limited to records needed for accountability or claims

Accounting records

Operational retention rule: Six years for vouchers and transaction correspondence, and ten years for financial statements, books and the statutory record classes under the Finnish Accounting Act

Webflow form original after a future verified transfer

Operational retention rule: Delete within 30 days after successful, auditable transfer

Candidate application

Operational retention rule: 24 months from recruitment closure or the last meaningful recruitment activity

Sourced or referred person who does not engage

Operational retention rule: Six months from first notice or contact

Talent pool or Connect profile

Operational retention rule: 24 months from consent or last meaningful activity; renew before expiry or delete within 30 days

Job alerts

Operational retention rule: Until withdrawal or 24 months of inactivity, then reconfirm or delete

Candidate career-development consent

Operational retention rule: Until withdrawal or 24 months of inactivity, then reconfirm or delete

B2B marketing consent

Operational retention rule: Until withdrawal or 24 months of inactivity, then reconfirm or stop marketing

Consent evidence

Operational retention rule: Three years after withdrawal, expiry or last reliance

Minimal suppression record

Operational retention rule: Six years with annual necessity review, or until valid new consent, solely to prevent prohibited contact

Rights-request case file

Operational retention rule: Three years after closure

GA4 user and event data

Operational retention rule: 14 months, which must be configured and verified in the property

Technical relay queue

Operational retention rule: 30 days maximum

Operational and delivery logs

Operational retention rule: 90 days unless a specific incident or legal hold requires longer

Rolling encrypted backups

Operational retention rule: 90 days, deleted through the normal rotation cycle

Keep the existing retention table. Interpret Technical relay queue: 30 days maximum, Operational and delivery logs: 90 days, Rolling encrypted backups: 90 days, the purpose-specific 24-month inactivity rules, three-year permission evidence and six-year minimal suppression record as applying to reQruitz's own Task 12 runtime records. Brevo transactional logs are configured to three calendar months because Brevo's account control uses whole months rather than an exact 90-day period; email previews remain disabled. Pending work is cancelled when a rights freeze, withdrawal or shared email block applies. A legal hold prevents deletion only for the record and period covered by the hold. Unknown provider outcomes are not resent automatically.

10. Security

The relays use encrypted transmission, encrypted delivery fields, separately keyed lookup references, bounded request bodies, timestamped signatures, replay protection, least-privilege bindings, disabled-by-default feature flags, controlled Queue retries, structured logs without direct identifiers, scheduled retention and auditable deletion. Webflow originals are deleted only by known submission ID after the relevant transfer and audit conditions are satisfied.

11. Your rights

Depending on the circumstances, you may request access to and a copy of your data; correction; deletion; restriction; portability of data processed by automated means on consent or contract; and information about recipients. You may object to legitimate-interest processing on grounds relating to your situation and may object to direct marketing at any time. You may withdraw consent at any time without affecting processing performed before withdrawal.

Send a request to Kasper.Kullberg@reqruitz.com. We may ask for information necessary to verify identity. We normally respond within one month, subject to the extensions permitted by law. You may complain to Finland's Office of the Data Protection Ombudsman at tietosuoja.fi. We encourage you to contact us first so that we can address the issue.

12. Children and minors

The website and client services are not directed to children. Recruitment may exceptionally concern a minor who is legally eligible for the role. In that case, we use age-appropriate information, collect only necessary data and apply any consent, guardian or employment-law requirements relevant to the person's age and circumstances. Optional marketing and career-development communications should not be offered to children without a separately verified lawful design.

13. Cookies and related technologies

The separate Cookie Policy describes the verified reqruitz.com technologies, durations and consent controls. Analytics remains blocked until consent. Teamtailor's career-site cookies are governed by Teamtailor's separate Cookie Policy.

14. Changes

We may update this notice when processing, systems, providers or law changes. The version, effective date and material changes will be shown here. A new purpose or materially different use will not be introduced merely by editing this notice; the legal basis, system configuration and any required choice must be established first.

Primary sources

Accessed 16 July 2026: GDPR, EUR-Lex, Finnish Data Protection Act, Finlex, Act on the Protection of Privacy in Working Life, Finlex, Act on Electronic Communications Services, Finlex, Accounting Act, Finlex, Office of the Data Protection Ombudsman, European Commission information duties, EDPB consent guidance, Teamtailor privacy settings, Teamtailor Europe subprocessors, Teamtailor Co-pilot privacy, Webflow privacy FAQs, Google Consent Mode, Cloudflare cookie documentation.

‍