Privacy policy
This policy explains what we do with your personal data when you apply for a job through one of our sites, send us an enquiry as an employer, or simply browse. We are the data controller for that data, and we are responsible to you for it under the GDPR.
Who is responsible for your data
CR Recruiting Group ApS (trading as Clever Recruiting) is the data controller.
CR Recruiting Group ApS
Låddenhøj 127A, st 404, 4000 Roskilde, Denmark
CVR 46664426
hr@clever-recruiting.dk
We are not required to appoint a Data Protection Officer, and we have not appointed one. Write to the address above and your message reaches the people who actually handle the data.
What we collect
- When you apply for a job: your name, email, phone number, the city you can work in, the language(s) you speak, your work eligibility, whatever you write in the message field, and your CV if you attach one. Depending on the site, a few role-specific answers too, such as which driving licence you hold or which kitchen sections you have worked.
- When you contact us as an employer: your name, company, email, phone number and what you write to us.
- When we talk to you afterwards: notes from calls and emails, the status of your application, and which employers we have shared your profile with.
- Automatically, on every visit: your IP address, browser and device type, the pages you open and the site you came from. Our hosting provider logs this to keep the site running and to block abuse.
- Your cookie choices: which categories you accepted or rejected, and when.
Why we use it, and on what legal basis
Where we rely on consent, you can withdraw it at any time and we will stop. Withdrawing does not undo anything we did lawfully before you withdrew.
| What we do | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Review your application and match you to open roles | This is the service you asked us for | 6(1)(b) — steps taken at your request before a contract |
| Share your profile with an employer | An employer cannot consider you without seeing it | 6(1)(a) — your consent, which you can withdraw at any time |
| Contact you about roles, by phone, email or SMS | To tell you about work that fits you | 6(1)(a) — your consent (also required by markedsføringsloven § 10) |
| Keep your profile on file for future openings | So you do not have to apply again every time | 6(1)(a) — your consent, renewed every 12 months |
| Handle enquiries from employers | To answer you and prepare an offer | 6(1)(b) and 6(1)(f) — our legitimate interest in running the business |
| Keep the site up, secure and free of abuse | Server logs, rate limiting, spam filtering | 6(1)(f) — our legitimate interest in a working website |
| Statistics and marketing cookies | To understand how the site is used | 6(1)(a) — your consent, given in the cookie banner |
| Bookkeeping and accounting records | Danish law requires it | 6(1)(c) — a legal obligation (bogføringsloven) |
Who we share it with
We do not sell your data. We share it only with the following, and only as far as each needs it:
- Employers you are being considered by. We tell you which ones, and we ask before the first time.
- Supabase — the database and file storage where your application lives, hosted in the EU.
- Cloudflare — serves these websites and receives the request logs described above.
- Email and SMS providers — used to send you messages you have agreed to receive.
- Public authorities — if the law obliges us to hand something over.
Transfers outside the EU/EEA
We keep your data in the EU wherever we can. Some of our providers are US companies that may process data outside the EU/EEA. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses, or by the provider's certification under the EU–US Data Privacy Framework. Write to us if you want to see the specific safeguard for a specific provider.
How long we keep it
You do not have to wait for any of these periods. Ask us to delete you and we will, unless a law says we have to keep something specific.
- Applications and candidate profiles: 24 months from the last time we were in contact with you. After that the profile is automatically anonymised — your name, contact details, CV and notes are erased, and only non-identifying facts such as industry and city remain for our own statistics.
- Your consent to be contacted: 12 months. We ask you again before it runs out; if you do not renew it, we stop contacting you.
- Employer enquiries: as long as we are in contact, and afterwards for as long as the bookkeeping rules require.
- Server logs: a short period set by our hosting provider, for security purposes.
- Your cookie choices: 12 months, then we ask again.
Your rights
Under the GDPR you have the right to:
- Get a copy of the personal data we hold about you (art. 15).
- Correct anything that is wrong or out of date (art. 16).
- Have it erased (art. 17).
- Restrict what we do with it while a question is being sorted out (art. 18).
- Take it with you in a machine-readable file (art. 20).
- Object to processing we base on legitimate interest (art. 21).
- Withdraw consent at any time, without giving a reason (art. 7(3)).
How to use those rights
Email hr@clever-recruiting.dk and say what you want. We answer within one month. We may ask you to confirm who you are first, so that we do not hand your data to somebody else.
Using your rights is free. If a request is clearly unfounded or excessive we may charge a reasonable fee or refuse it, and we will explain why if that ever happens.
Automated decisions
We do not make decisions about you by automated means alone. A person reads your profile before it goes to an employer, and a person decides whether to put you forward.
Some calls we make to candidates are placed by an automated calling system. If you receive one, it says so at the start of the call, tells you if the call is recorded, and you can ask to speak to a person or to be taken off the list at any time. Ask us to stop calling and we add your number to a suppression list that we keep even after your profile is deleted, so the calls actually stop.
Security
Your data sits in a database with row-level access rules, so an employer account can only ever see the candidates that have been shared with it. CVs are held in a private storage bucket that is not reachable from the open internet. Access by our own staff is limited to the people who need it and is logged.
No system is perfect. If a breach happens that puts you at risk, we will tell you and the Danish Data Protection Agency as the law requires.
Children
Our sites are aimed at people looking for work and are not intended for children under 15. We do not knowingly collect data about them. If you think we have, tell us and we will delete it.
Complaints
If you think we are handling your data wrongly, please tell us first — it is usually the fastest way to fix it. You also have the right to complain to the Danish Data Protection Agency:
Datatilsynet
Carl Jacobsens Vej 35
2500 Valby
Denmark
www.datatilsynet.dk
Changes to this policy
We update this page when what we do changes. The date at the top tells you when it was last revised. This version is from 2026-08-10.