Recrur Services OÜ (hereinafter Recrur) acts as a personal data controller. The following explains how we process personal data.
We process personal data pursuant to the General Data Protection Regulation and any specific laws.
Our Data Protection Officer is Marit Alaväli; her email address is support@recrur.com.
I Definitions
To help you understand privacy notices, we will explain some of the key terms used in privacy notices.
- A data subject is a natural person whose personal data is processed by Recrur. Data subjects are Recrur’s customers, invoice payers, authorised and legal representatives, and request submitters (e.g. potential customers, Recrur’s customer’s applicants).
- Personal data is any information about an identified or identifiable natural person (‘data subject’). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
- A customer is a legal person who uses Recrur’s services or has expressed a wish to use Recrur’s services (a potential customer) or has been a user of Recrur’s services in the past (a former customer).
- Customer’s applicants are natural persons who submit application details to Recrur’s customer via the platform provided by Recrur.
- Customer’s authorised representative is a natural person who represents the data subject based on authorisation.
- A legal representative of a customer is a natural person who is a member of the board of a legal person or a body substituting for it.
- Another occasional contact is a natural person who does not have a customer relationship with Recrur (e.g. invoice payer, request submitter).
- Business partners are natural or legal persons or public authorities with whom personal data is processed or transferred in the course of business activities. According to this document, partners are recipients, processors, and third parties.
- Recipient of personal data is a natural or legal person to whom data is transferred in the context of processing personal data.
- Processors are natural or legal persons who are authorised by Recrur to process personal data held by Recrur.
- Third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
- Platform means online environments managed by Recrur: website https://recrur.ee/, self-service environment of the recruitment software https://app.recrur.com/login?lang=et_EE.
| Purpose | Activity | Legal basis | Data provision basis | Consequence of failure to provide data | Retention period |
| Sales | – Sending sales offers – Pre-contractual negotiations | – Legitimate interest: increasing the company’s turnover | Submission of data is voluntary | Non-transmission of a sales offer and restrictions on pre-contractual negotiations | Three years from the date or sending the offer |
| Conclusion and termination of a contract | – Formalising the contract – Concluding the contract | – Legitimate interest: protection of company rights | Requirement for the conclusion of a contract | Service is not provided | Three years from the termination of the contract |
| Customer service | – Creating user accounts | – Data processing at the request of the data subject necessary for the conclusion of the contract and performance of the contract. | Contractual obligation | User accounts are not created | 14 days from the termination of the contract |
| Settlement | – Invoicing – Issuing an invoice | – Data processing at the request of the data subject necessary for the conclusion of the contract and performance of the contract. | Contractual obligation | Service is not provided | Seven years from the end of the financial year in which the transaction was recorded in the accounting register. |
| Marketing | – Organising webinars/seminars – Sending newsletters – Using social media | – Legitimate interest: increasing the company’s turnover – Consent of the data subject. | Submission of data is voluntary | Missing out on promotional content/webinars offered by Recrur; not receiving newsletters. | 1–3 years |
| Personal data management | – Rectification of personal data | – Compliance with a legal obligation — Data processing at the request of the data subject necessary for the conclusion of the contract and performance of the contract. | Contractual obligation | Performance of the contract may be prevented | 3.5 years from the termination of the contract |
| Ensuring data protection | – Responding to data requests | – Compliance with a legal obligation | Submission of data is voluntary | Responding to a request may be prevented | 3.5 years from the termination of the contract |
| Use of cookies | – Saving cookies | – Legitimate interest: ensuring the functioning of the website – Consent of the data subject. | Submission of data is voluntary | Website use may be limited | As set out in the cookie policy |
Recrur ensures the lawfulness of the processing of personal data and attaches great importance to the confidentiality and protection of personal data. Recrur aims to ensure responsible processing of personal data based on the interests, rights, and freedoms of the data subject.
The exact scope of the personal data processed by Recrur depends on the purposes for which the personal data are processed. Recrur collects personal data only for specified and legitimate purposes and does not subsequently process them in a way that is incompatible with those purposes.
Here, we provide the relevant information about the purposes and activities of processing personal data based on whether the data is obtained from the customer, generated during the cooperation between the customer and Recrur, or obtained from a third party.
II Processing activities with data received from the data subject
Here, we provide an overview of the purposes and activities for which we collect personal data from the data subject, the legal basis on which we process it, and the period for which we retain this data. We will also explain if providing personal data is required by law or contract, or for the conclusion of a contract, and the consequences of not providing the data.
III Processing activities involving data generated during the cooperation between Recrur and the customer or obtained by Recrur from a third party
In addition to processing data we receive from the data subject, we also generate data about the data subject in the course of our cooperation. We also receive data from third parties.
Here we will outline the reasons and procedures for processing the personal data we have collected from a third party, along with the legal basis for such processing. In addition, we will explain what personal data we process and how long we retain this data.
| Purpose | Activity | Legal basis | Categories of the personal data; | Source of personal data | Retention period |
| Settlement | – Linking payments to the customer | Data processing at the request of the data subject necessary for the conclusion of the contract and performance of the contract. | Invoice details, invoice payer details | Company’s system | Seven years from the end of the financial year in which the transaction was recorded in the accounting register. |
| Conclusion and termination of a contract | – Termination of a contract | Data processing at the request of the data subject necessary for the conclusion of the contract and performance of the contract. | Name, email address | Company’s system | Three years from the termination of the contract |
| Contract management | – Archiving contracts | Legitimate interest: protection of company rights | Name, email address, contract details | Company’s system | Three years from the termination of the contract |
| Improving service quality | – Requesting feedback | Legitimate interest: ensuring customer satisfaction | Email address | Company’s system | One year from the date of feedback |
| Provision of service | – Running recruitment campaigns on social media – Creating a career page – Managing the career page – Recruitment audit/consultation | Data processing at the request of the data subject necessary for the conclusion of the contract and performance of the contract. | Name, email address | Company’s system | Three years from the termination of the contract |
| Customer service | – Account management – Account deletion – Training of customer representatives – Technical advice. | Data processing at the request of the data subject necessary for the conclusion of the contract and performance of the contract. | Name, email address, telephone number | Company’s system | 14 days from the termination of a contract Three years from the termination of a contract |
| Notifications to ensure performance of the contract | – Sending a debt notification by email | Legitimate interest: hedging the credit risk of the company | Name, email address, invoice details | Company’s system | Three years from the termination of a contract |
| Marketing | – Sending promotional offers | Legitimate interest: increasing the company’s turnover | Name, email address | Another service provider | Three years from the date of the offer |
| Sales | – Finding a sales lead | Legitimate interest: increasing the company’s turnover | Name, email address, social media details | Another service provider | Three years from contact |
| Personal data management | – Deletion of personal data | Compliance with a legal obligation | Name, email address, telephone number, bank account number. | Company’s system | Personal data are deleted after 3.5 years from the date of termination of the contract, and no personalised record will be retained upon deletion. |
| Ensuring data protection | – Resolving data protection incidents | Compliance with a legal obligation | Name, email address | Company’s system | 3.5 years from the termination of the contract |
| Ensuring information security | – Use of logs and data to investigate issues – Creating backups | Legitimate interest: ensuring the performance of the company and avoiding losses | Name, email address, telephone number, and customer’s applicant’s application details. | Company’s system | 3.5 years from the termination of the contract |
| Software management | – Solving a technical problem | Legitimate interest: ensuring the performance of the software | Name, email address, telephone number, and customer’s applicant’s application details. | Company’s system | 14 days from the termination of the contract |
| Use of cookies | – Deleting cookies | Statutory obligation | IP address | Company’s system | As set out in the cookie policy |
Recrur will retain personal data for as long as necessary to achieve the purpose of the processing. If Recrur wishes to retain personal data beyond the period necessary for the purpose of collection, Recrur must anonymise the data in a manner that renders the data subject unidentifiable.
Legitimate interest analyses can be accessed by sending a request to support@recrur.com.
IV Profiling, including automated decisions
Recrur does not carry out profiling, including automated decisions, in the context of processing personal data.
V Disclosure of personal data to partners
Transferring personal data to partners may be necessary in the context of cooperation between Recrur and a customer.
Data will be disclosed or transmitted to the following partners:
accounting service provider;
auditor;
website administrator;
server administrator;
state agencies;
marketing partners;
another controller when transferring data.
Partners are entitled to process personal data only to the extent necessary to fulfil the purposes assigned to them by Recrur. Partners must comply with Recrur’s requirements regarding the processing of personal data.
VI Transfer of data to a partner in a third country
We transfer personal data to partners in third countries, and the EU-US Data Privacy Framework applies to ensure the protection of personal data.
VII Your rights
You have the right to be informed about the conditions of data processing. We will make the terms and conditions of data processing available to you on the basis of this document or a relevant request.
You have the right to access the information referred to in points 1 and 2 of Article 15 of the Regulation. We will make the information referred to in points 1 and 2 of Article 15 of the GDPR available to you based on this document or by request.
You have the right to request the rectification of your personal data. You can correct your data by submitting a signed request.
You have the right to the erasure of your personal data (‘right to be forgotten’). You have the right to have your personal data erased, for example, if you have withdrawn your consent to the processing and there is no other legal basis for processing your data.
You have the right to restrict the processing of your personal data. You have the right to request the restriction of the processing of your personal data if the processing of your personal data is not permitted by law or if you contest the accuracy of your personal data. You have the right to request the restriction of the processing of personal data so that we can verify the correctness of personal data or if the processing of personal data is unlawful, but you do not request the erasure of personal data.
You have the right to access the personal data you have provided to us about yourself and the right to transfer that data to another controller (data portability).
You have the right to object at any time to the processing of personal data relating to you. This includes the right to object to profiling based on legitimate interest.
If you believe that your rights have been violated in processing your personal data, you have the right to lodge a complaint with us, the Data Protection Inspectorate, or the court. You can contact the Data Protection Inspectorate on their website https://aki.ee/.
If you would like to contact us with your request or objection, please write to support@recrur.com. We will reply within one month as from receiving your request or objection at the latest. We may, if necessary, extend this period by two months, taking into account the complexity and the number of requests or objections. In this case, we will inform you of the deadline extension for responding and the reasons for the delay within one day of receiving your request or objection. If we receive your request electronically, we will also respond to you electronically unless you prefer to receive our response in another way.
We have the right to refuse your request to exercise your rights if we cannot identify you as the data subject (for example, if we receive a request from a person with whom we do not have a customer relationship).
If we do not take action based on your request or objection, we will inform you within one month of receiving your request or objection. We will explain the reasons for not taking action and let you know about the option to lodge a complaint with the supervisory authorities and seek redress.
VIII Other terms
Recrur reserves the right to update, clarify, and amend the terms and conditions at any time, based on changes in legislation and the services provided by Recrur.
Updated 11.7.2023 in cooperation with data protection specialists at DataVie OÜ.
We value your privacy
We use cookies to improve your browsing experience, display personalised ads or content, and analyse website traffic. By clicking ‘Allow all’, you agree to the use of all cookies. Please note that disabling cookies may affect the website’s functionality, and you will no longer see personalised content.
