Privacy Policy for ProsjektCV.no

About ProsjektCV.no and the data controller

ProsjektCV.no is a digital platform that connects engineers and other candidates (job seekers) with potential employers in a safe and efficient manner. We highly value your privacy and process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable legislation. ProsjektCV Ltd (org. no. 835 683 532), Ryensvingen 7, 0680 Oslo, is the data controller for the personal data collected through the platform.

This privacy policy explains how we collect, use, and share personal data about our users, both candidates and business clients (employers). A key principle of the service is that candidates remain anonymous to employers until they actively consent to open dialogue. Below you will find information about what data we process, why we do it, what rights you have, and how you can contact us with questions about privacy.

What personal data we collect

We process both information that you provide directly to us and data that is generated automatically when you use ProsjektCV.no.

Candidate Information

• Profile information Information you register in your candidate profile, such as name, contact information (email address, telephone number), CV (education, work experience, skills), qualifications, photo (if you upload one), preferences (e.g., geographic area, commute distance, desired salary, type of projects) etc. This information is stored to present your profile. (Note: Contact details such as name, email and phone number are automatically anonymised and will not be shown to employers until you actively choose to share them.)
• Further information: Any additional information you provide, such as keywords and categories describing your competence and preferences (to improve matching), as well as any documents you upload (e.g. CV documents). You can also import CV information from third-party services like LinkedIn; in that case, we will obtain the information you agree to share from that service.
• Platform activities: Information about your use of the service, such as which job or project advertisements you show interest in (by clicking "Express Interest"), the times of your logins, and other actions you perform. This helps us track your preferences and activity on the platform.
• Employment outcome If you get a job via the platform and this is registered (e.g. the employer marks that you are employed), we will store information about this outcome. We do this to be able to manage our services (e.g. invoicing of any recruitment fee) and to gather statistics on the platform's effectiveness.

Information about customers (employers)

• Account details: Information about the business and contact persons provided when registering a company account. This includes company name, organisation number, address, industry, and the name, job title, email, and phone number of the contact person (and any other users linked to the customer account). Each user associated with a business customer has personal login details (username/email and password).
• Payment and subscription information: Information relating to the customer relationship, such as invoicing address, invoicing contact person and any references. (Note: We store not payment card information on our servers, as subscriptions and payments are handled via invoice or other payment solutions.
• Customer-published content Data entered onto the platform by the customer, e.g. job advertisements, project descriptions and messages sent to candidates. This content may contain personal data (e.g. the name of a recruiter in a message) and is stored in our database as part of the service.

Usage data and technical information

• Technical data: When you use the service, we automatically collect certain technical information, such as IP address, device type, operating system, browser, screen resolution, and the time of visits and actions.
• User behaviour We also log how you navigate and interact with the platform – for example, which pages or profiles you view, searches you perform, clicks on ads or profiles, and other user actions. This data helps us understand usage patterns and improve the service.
• Cookies We use cookies and similar technologies to collect some of the technical information and usage data mentioned above. Cookies are small text files stored in your browser that allow our website to recognise you. These are used, among other things, to keep you logged in, remember your preferences, and collect usage statistics. (See the section Cookies and similar technologies (for details, see below.)

Communication and Support

• Messages and dialogue All communication through the platform between candidates and clients is stored. This includes contact requests, chat conversations and messages you send or receive via ProsjektCV.no, as well as metadata such as message timestamps. We retain this to facilitate dialogue, ensure compliance with the terms of use, and be able to moderate content in cases of misuse.
• Customer service inquiries If you contact us by email, phone or other channels, we will keep a log of the inquiry. This includes any contact details you provide and the content of your request or problem. We use this information to help you, resolve issues, and improve our customer service.

Aggregated and anonymised data

• Statistics We can develop statistical data and reports based on aggregated information. For example, we can gather data showing how many candidates possess a specific skill, or how many positions are filled via the platform. Such summaries contain no identifiable personal data, and we can use or share such aggregated insights (e.g., to illustrate labour market trends) without compromising privacy.

How we use the information (purpose)

We process your personal data solely for purposes that are legitimate and necessary to operate and improve the service. The main purposes are:

• Deliver and operate the service To create user accounts and allow you to use the platform. This includes displaying candidate profiles (anonymised) to relevant employers, allowing clients to post projects/positions, offering a search function for candidates and clients, and facilitating contact between candidates and employers through features such as "Express Interest", contact requests and chat.
• Effective recruitment process To facilitate an efficient recruitment process. We use the information you have provided to match candidates with suitable job opportunities (and vice versa). When a candidate consents, we share necessary information with the client to carry out the recruitment process (e.g. full CV and contact details). Clients can manage their recruitment activities via the platform (e.g. keep track of applications and mark hires).
• Personalised recommendations To provide users with relevant suggestions and content. For candidates, this means we can recommend job postings or projects that match your profile and activity. For clients, this may involve suggestions of potential candidate profiles within the areas of expertise you are interested in.
• Communication and notifications To send you messages necessary for the use of the service. This includes emails or app notifications about new contact requests, chat messages, status updates in your recruitment processes, or changes to our terms or policies. If you have given consent, we may also send newsletters, marketing, or information about new services/offers from us (or our recruitment partners). You can opt out of such voluntary communication at any time.
• Service improvement To analyse and understand how the platform is used, so that we can improve the user experience and functionality. We use aggregated usage data, user feedback, and results (e.g. how many are hired via the platform) to identify areas for improvement, fix issues, and develop new features and services that benefit our users.
• Security and abuse management To protect our users and ensure a secure platform, we monitor activities to detect potential fraud, unauthorised access, spam, or breaches of our terms of use. If misuse is suspected, we may review communications (e.g. messages) and take appropriate action (such as warnings, account suspension, or reporting to authorities in serious cases).
• Legal compliance To fulfil our legal obligations. This includes maintaining bookkeeping and reporting duties (e.g., storing invoice and payment information for customers in accordance with accounting legislation), complying with any lawful orders from public authorities, or retaining information necessary to establish, exercise or defend legal claims, disputes or to enforce agreements we have entered into.
• Administration and payment for customers: For business customers, we process the necessary personal data to manage subscriptions, user accesses and payments. This includes sending invoices, recording payments, calculating any recruitment fees when a candidate is hired through the platform, and following up on late payments.

We base our processing of personal data on various legal grounds depending on the context: Essentially, the processing is necessary to fulfil the agreement with you as the user (for example, to deliver the services you expect). Some treatments are based on our legitimate interest to ensure the service's functionality, security, and continuous improvement (we always perform a balancing act to protect your privacy and will not override your rights without cause). Where we ask for your consent - for example, to send newsletters by email or for a candidate's identifiable profile to be shared with a specific employer - you can withdraw your consent at any time. We may also process data to fulfil Legal obligations, for example, storing transaction data for regulatory requirements.

Cookies and similar technologies

ProsjektCV.no uses cookies and similar tracking technologies to improve functionality and user experience. A cookie is a small text file that is stored in your browser when you visit a website. We use cookies for several purposes:

• Necessary cookies: These are essential for the website and login functionality to work (e.g. remembering that you are logged in and maintaining your session). They are required for the service to function correctly.
• Functional cookies These remember preferences you have chosen, such as language or other user settings, to provide a more tailored experience.
• Analyse cookies These help us collect anonymised statistics on traffic and platform usage so we can understand user behaviour. This helps us to improve the service over time. We may use third-party analytics services that place cookies on our behalf (without receiving directly identifiable personal data about you).

You can control the use of cookies through your browser settings. There, you can delete or block cookies from our website (and others). Note that if you choose to block all cookies, certain parts of ProsjektCV.no may not function optimally or at all (for example, you will not be able to stay logged in without cookies). By using our website, we assume that you consent to the use of necessary cookies. For other types of cookies, we will obtain consent via a cookie banner or via your browser settings in accordance with legal requirements.

Sharing of personal data

We value your privacy and do not share personal data with third parties unless it is necessary to deliver our services or we have a legal basis to do so. Below, we explain how data may be shared in connection with our service:

Sharing between candidates and customers

A core function of ProsjektCV.no is to connect candidates and employers, while protecting candidates' identities until they choose to reveal them. In practice, this involves:

• Anonymised profile viewing: Candidate profiles shown to employers via searches or lists are anonymised. Employers with access to the platform can see a candidate's skills, experience, education, key qualifications, and other relevant information, but without name, contact details, or other direct identifiers. Any details that could reveal identity (for example, your name or current employer if it can identify you) have been removed or hidden in this view.
• Contact requests If an employer finds an interesting anonymised profile, they can send a digital contact request through the platform – usually with information about the relevant position or project. The candidate then receives a notification with basic details about the opportunity and about who the employer is (e.g. company name and a project description). The candidate is then free to accept or reject The request. The candidate remains anonymous until they potentially accept.
• Following consent (open dialogue): If the candidate accepts a contact request – thereby consenting to open a direct dialogue – the employer will gain access to the candidate's full profile. This means that the candidate's name, contact details (email, phone) and previously hidden details from their CV/profile will become visible to the employer in question. The candidate's information will be made available to the employer's users for a limited period only (typically around 6 months) to carry out the recruitment process. After this period (or if the dialogue is terminated without a hire), the candidate's profile will again appear anonymised to the employer in question.
• Candidate's insight into employer information: Correspondingly, the candidate will see information about the employer when a request is sent. Candidates can see the company name, description of the position/project, and other relevant details the employer includes in the request. When the dialogue opens, the candidate will also normally know the identity (name) of the recruitment person they are communicating with via the chat.
• Confidentiality. All information exchanged between a candidate and an employer via ProsjektCV.no shall be treated confidentially by both parties. The employer undertakes to use the candidate's information exclusively for legitimate recruitment purposes related to the current dialogue, and not to share it further without the candidate's explicit consent. Employers are also not permitted to attempt to identify or contact candidates outside the platform before the candidate has given consent (for example, by using information from an anonymous profile to search for them on LinkedIn or in other ways). If an employer downloads or saves a candidate's CV outside the platform, they are considered their own data controller for that copy and must comply with data protection legislation themselves (for example, by not storing data for longer than necessary without obtaining the candidate's consent).

Sharing with service providers

We use trusted sub-processors to help us operate and improve the service. This may include IT operations and infrastructure (cloud storage and data servers), email and message dispatch, payment processing, analytics services, and customer support systems. These suppliers are only granted access to personal data to the extent necessary for them to perform their tasks on our behalf. We have data processing agreements with all such suppliers, which impose confidentiality obligations and require them to protect the data in accordance with our requirements and legal regulations. They are not permitted to use your information for their own purposes.

Statutory disclosure

In certain situations, we may be legally obliged to disclose personal data to third parties. For example, the police, tax authorities, or other public bodies may have the right to demand disclosure of specific information through a court order or legal provision. We may also share information if it is necessary to enforce our terms or rights (e.g., in the collection of outstanding payments or the handling of legal disputes), or to protect ourselves or others from harm or illegal activities (e.g., in the investigation of fraud or security breaches).

Business transfer

Should ProsjektCV AS undergo a business change, such as a merger, acquisition, or sale of all or part of the company, personal data about our users may be transferred to new owners or parties who take over the operation of the service. In such a case, your data will still be subject to confidentiality and will not be used for new purposes without informing you. We will notify affected users of any ownership changes that result in changes to how personal data is processed.

Storage and deletion of information

We store your personal data for as long as it is necessary to fulfil the purposes described in this statement and to comply with legal obligations. The storage period will vary depending on the type of data and its use:

• Active account As long as you have an active account with ProsjektCV.no (either as a candidate or a client), we will store information linked to your account. This is necessary for us to be able to provide the service to you continuously. Information such as profile information, candidate CVs, company profiles, message history, etc. are stored in our system until you change or delete them, or until you close your account.
• Account deletion: If you choose to close your account or ask us to delete your personal data, we will comply unless we have a legal basis for further retention. Most data will then be permanently deleted or anonymised. Please note that you can remove or change much of your information yourself via your profile settings. For full account closure, you can contact us, and we will confirm deletion once it has been performed. After deletion, your profile will no longer be visible to anyone, and any links to employers will be removed.
• Logs and backups Technical logs and backups may retain fragments of your information for a short period after deletion, before they are overwritten. We limit access to such stored data and ensure that it is completely deleted or anonymised after a reasonable period of time.
• Mandatory storage In certain cases, we may need to retain some data even after you have deleted your account if required by law. For example, accounting regulations may require us to store invoices and transaction history for a certain number of years (typically 5 years). Similarly, we may retain specific information if there is an outstanding legal obligation or dispute. Such retention is limited in scope and duration to what is necessary, and we will delete the information once the purpose of retention ceases.

Your rights

As a user of ProsjektCV.no and a registered individual, you have several rights related to your personal data. We facilitate your ability to exercise these rights:

• Transparency You have the right to know what personal data we hold about you and to request a copy of this data (with certain statutory exceptions). This also includes information on how we process your data.
• Retting: If any of the personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected or updated. You can change much of the information yourself via your profile, and you can otherwise contact us to request correction.
• Deletion You can request the deletion of your personal data in certain situations (“the right to be forgotten”) – for example, if the data is no longer necessary for the purpose for which it was collected, or if you withdraw your consent and we do not have another legal basis for processing it. We will comply with deletion requests where possible and permitted by law (please note that certain information must be retained for a specific period due to legal requirements, see the section above).
• Treatment limitation: You have the right to ask us to temporarily stop processing your personal data under certain circumstances. For example, this may be applicable while you are disputing the accuracy of the data or the lawfulness of our processing. If processing is restricted, we will continue to store the information but will not process it further until the restriction is lifted.
• Data portability: For personal data you have provided to us, you have the right to receive this data in a structured, commonly used, and machine-readable format. You also have the right to ask us to transfer such data directly to another service provider, if technically feasible. This right only applies to data that we process automatically based on your consent or an agreement with you.
• Protest (right to object): You have the right to object to certain types of processing of your personal data. For example, you can opt out of us using your data for direct marketing. In practice, you can unsubscribe from marketing emails at any time by following the instructions in such emails or by contacting us. If we process data based on legitimate interest, you can also object to this; we will then consider your objection and will only continue processing if we have compelling legitimate grounds that outweigh your privacy.
• Withdraw consent If we process personal data based on your consent, you have the right to withdraw your consent at any time. This does not affect the lawfulness of previous processing, but means that we will stop the relevant processing going forward. For example, you can change your newsletter settings at any time to withdraw consent for email marketing.
• Complaint to supervisory authority If you believe that our processing of your personal data breaches the law, you have the right to complain to the Norwegian Data Protection Authority (Datatilsynet). We encourage you to contact us first so that we can try to resolve your issue directly – we take privacy seriously and will do our best to rectify any problems. However, you are free to contact Datatilsynet if you are not satisfied with our handling of your case.

To exercise your rights, you can contact us via the contact details at the bottom. We will respond as quickly as possible, and no later than within the statutory deadlines (usually within 30 days). Exercising your rights is free of charge for you, unless your requests are manifestly unfounded or excessive (in which case we may either reject them or charge a reasonable fee).

Security and data protection

We take information security seriously and have implemented a number of measures to protect your personal data:

• Technical measures: We use encryption (including HTTPS/SSL) to protect data sent between you and our service over the internet. Sensitive information (such as passwords) is stored encrypted/hashed in our systems. We have firewalls and monitoring systems in place to detect and prevent unauthorised access to our servers.
• Organisational measures When authorised personnel at ProsjektCV (or our data processors) have access to personal data, and then exclusively for purposes as stated in this declaration. Our employees and partners are subject to a duty of confidentiality. We also ensure training and awareness internally regarding personal data protection and security.
• Anonymisation and pseudonymisation: Where possible, we reduce the amount of identifiable information in our systems. For example, candidate details are displayed anonymously to prospective employers until the candidate chooses to share their identity.
• User responsibility You also contribute to protecting your data by having a strong password, protecting your login details and logging out after using the service on shared devices. We will never ask you for your password in unsolicited requests. If you notice any suspicious activity on your account, please contact us immediately.
• Incident management Should a security incident or data breach occur that affects your personal data, we will notify affected users and relevant authorities (such as the Data Protection Authority) in accordance with legal requirements. We have established procedures for handling such situations to minimise damage and prevent recurrence.

Transfer of data outside the EU/EEA

ProsjektCV.no primarily processes and stores personal data within the EU/EEA. Should we, in certain circumstances, need to transfer personal data to countries outside the EU/EEA (for example, if we use a subcontractor in a third country), we will ensure that the necessary safeguards are in place to protect your rights and data. This may involve the use of EU Standard Contractual Clauses in agreements with the recipient, ensuring that the recipient country is approved by the EU Commission as a country with adequate data protection, or other lawful transfer mechanisms in accordance with data protection regulations.

You can contact us if you would like more information about any transfer of your data to third countries and what measures have been implemented to protect the data in that regard.

Children's privacy

The services of ProsjektCV.no are not aimed at children under the age of 15, and we do not knowingly collect personal data from anyone we know to be under this age. You must be 15 years of age or older to register a candidate profile on our platform (or have valid consent from a guardian if permitted by applicable law). If you are under 15 years of age, please do not use the service or provide us with personal data.

If we become aware that we have mistakenly collected personal data from a child under the age of 15 without the necessary consent, we will delete the information without undue delay. Parents or guardians who discover that a child under the age limit has provided personal data to us can contact us so that we can remove the information.

Changes to the privacy policy

We may update this privacy policy from time to time to reflect changes in our services or new legal requirements. We will inform users clearly of any significant changes – for example, via email (to registered users) or through a visible notice on our website. The latest version of the policy will always be available on ProsjektCV.no, and we encourage you to review the privacy policy regularly. Last updatedThe date at the top of the document indicates when the declaration was last revised.

If you continue to use the service after an updated privacy policy comes into effect, it will be considered as acceptance of the changes. If you do not accept the updated policies, you must stop using ProsjektCV.no before the new terms come into effect.

Contact details

Do you have any questions about this privacy policy or wish to exercise your rights? Please feel free to contact us:

Person Responsible for Treatment ProsjektCV AS (Company No. 835 683 532)
Postal address: Ryensvingen 7, 0680 Oslo, Norway
E-mail Support@prosjektcv.no

We will answer enquiries as soon as possible, and at the latest within statutory deadlines.

If you have concerns about how we process personal data, we would like to hear from you so that we can help. Should we, against all odds, be unable to resolve your issue, you also have the right to contact the Norwegian Data Protection Authority (www.datatilsynet.no) to lodge a complaint.