About this policy
This policy explains which personal data [Company legal name] ("CruitUp", "we") processes, why, and what rights you have. It applies to cruitup.com, the CruitUp app, and the job ad pages we host for our customers.
Questions about privacy go to [privacy@cruitup.com].
Our roles
We process personal data in two different roles:
- As controller for data about our website visitors, our customers and their users (account, billing, support and usage data). This policy covers that processing in full.
- As processor for data about candidates who apply to a job through CruitUp. The hiring company that published the job ad is the controller and decides how candidate data is used. We process it only on its instructions, under our Data processing agreement. Candidates should read the privacy notice of the company they apply to; section 10 explains how to exercise your rights in that case.
Personal data we collect
- Account data: name, work email, password (stored as a hash), company name, role, and the team members you invite.
- Billing data: billing address, VAT number, purchased packages and invoices. Card details are handled by our payment provider; we never see or store full card numbers.
- Job and campaign data: job ad content, salary range, location, selected channels, budgets and campaign results such as reach, clicks and applications.
- Usage and device data: log data such as IP address, browser, pages visited, time stamps and error reports, used to run and secure the service.
- Communication data: messages you send to support or sales, and our replies.
- Candidate data (as processor): name, contact details, CV, answers to application questions, and notes the hiring company adds. See the DPA.
How we collect it
Most data comes from you directly, when you sign up, create a job ad, buy a campaign or contact us. Some data is created automatically when you use the website or app. Campaign performance data comes from the advertising platforms where your campaigns run.
Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing your account, job ads, the applicant board and campaigns | Contract, Art. 6(1)(b) |
| Billing, accounting and tax records | Legal obligation, Art. 6(1)(c) |
| Security, fraud prevention and debugging | Legitimate interests, Art. 6(1)(f) |
| Improving the product with aggregated, non-identifying statistics | Legitimate interests, Art. 6(1)(f) |
| Product updates and offers to existing customers | Legitimate interests, Art. 6(1)(f); you can opt out in every email |
| Newsletter and marketing to non-customers | Consent, Art. 6(1)(a) |
How long we keep it
- Account data: for as long as your account exists, then deleted within 90 days.
- Billing records: for the period required by tax and accounting law (in the Czech Republic, up to 10 years).
- Server logs: up to 90 days, unless needed to investigate a security incident.
- Candidate data: as instructed by the hiring company, and at the latest when its account is deleted.
Who receives it
We share personal data only where needed to run CruitUp:
- Service providers who process data on our behalf, such as hosting, email delivery, payment and support tools. They are bound by data processing agreements. The current list is in Appendix 2 of the DPA.
- Advertising platforms (for example Meta, LinkedIn, TikTok and Google) receive your job ad content and targeting settings when we run a campaign for you. They act as independent controllers for the data they collect from people who see or click your ads, under their own privacy policies.
- Authorities and advisers where the law requires it, or to establish or defend legal claims.
We do not sell personal data.
International transfers
We store data in the European Union where possible. When a provider processes data outside the EU or EEA, we rely on an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework) or on the Commission's Standard Contractual Clauses, with additional safeguards where needed.
Security
We use encryption in transit (TLS) and at rest, access controls with least privilege, logging, regular backups and staff confidentiality obligations. Appendix 1 of the DPA describes our technical and organisational measures in more detail.
Your rights
Under the GDPR you have the right to access your data, have it corrected or deleted, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time without affecting earlier processing.
To use these rights, write to [privacy@cruitup.com]. We reply within one month. If you applied to a job through CruitUp, contact the hiring company first; if you contact us, we forward your request to them.
You may also complain to a data protection supervisory authority, in particular in the EU country where you live or work. Our lead authority is the [supervisory authority, e.g. Office for Personal Data Protection (ÚOOÚ), Czech Republic].
Cookies
Our website uses only cookies and local storage that are strictly necessary to run it, such as keeping you signed in and remembering security settings. These do not require consent. If we introduce analytics or marketing cookies, we will ask for your consent first and update this policy.
Social media and third-party links
Our website links to our profiles on LinkedIn, Facebook and Instagram. We do not embed their plugins, so no data is sent to them until you click a link. Once you visit their sites, their own privacy policies apply.
Changes to this policy
We update this policy when our services or the law change. The date at the top shows the latest version. We tell customers about material changes by email before they take effect.