Privacy
Everything The NOD collects, why, and who else ever sees it.
Draft. This page states what the product actually does, in plain language, so it can be turned into a policy rather than assembled from a template. It has not been reviewed by counsel and it is not the published version.
The NOD is operated by Croft, Helsinki, Finland. For your candidate profile we are the data controller. For a company’s own hiring records inside its workspace, that company is the controller and we are its processor. The two roles are kept separate in the data model, not just in this document.
Your verified identity, from bank credentials or Mobile ID. Education confirmed against the issuing register. Employment confirmed by a named person at that employer. What you are open to: category, seniority, location, and a salary band. Applications you send and requests you accept or decline.
We do not collect behavioural data. There is no record of what you looked at, for how long, or what could be inferred from it.
The account holder’s identity, verified against a company domain. The roles you publish. Requests you send and the outcomes. Billing details for accepted meetings.
Consent, for everything on a candidate profile, withdrawn by deleting the account. Contract, for applications, requests and billing. Legitimate interest, for keeping the service secure and for the accounting records the law requires us to keep.
A company sees an anonymised profile when it queries the pool, and your identity only once you have accepted its request or applied to its role. Nobody else. Investors on a fund account can never see a candidate record of any kind. We do not sell access, and there is no arrangement under which a third party can buy it.
While your account is open. After deletion, removed inside thirty days, apart from accounting records that contain no candidate data.
Inside the European Union. No transfer to a third country occurs in the normal operation of the product.
A session cookie so you stay signed in, and a preference cookie so the site remembers what you chose. No advertising cookies, no cross-site tracking, and no third-party analytics that identify you.
Access, rectification, erasure, portability, objection, restriction, and an explanation of any automated decision. How to exercise each is set out on the GDPR page.
Write to us at [DPO CONTACT]. You also have the right to complain to your national supervisory authority; in Finland that is the Office of the Data Protection Ombudsman.