Privacy policy

1. Controller and contact details

HSBridge Oy (Duunijobs), Finnish Business ID 3559100-7, Finland. Privacy and data-subject requests: support@duunijobs.fi, phone +358 44 9784 936. Duunijobs currently has no appointed data protection officer.

2. Data we process and where it comes from

• account and authentication data: name, email, user role and session data;
• jobseeker data: contact details, location, CV, work history, education, languages, skills, work preferences, portfolio, photograph and recommendations;
• employer data: company and contact-person details, Business ID, job posts, requirements, messages and recruitment activity;
• service-generated data: ESCO suggestions, confirmations and rejections, transparent fit and coverage details, logs and security events;
• payment, contract, communication, support-request and email-delivery data.

Data mainly comes from you. Basic company information may be checked in the public Finnish YTJ/PRH register. We do not intentionally collect health data, trade-union membership, religion, political opinions or other special-category data from CVs, and such data is not used for matching. Do not include it unless necessary and lawful.

3. Purposes and legal bases (GDPR Article 6)

• Contract and pre-contractual steps (6(1)(b)): account administration, profile and CV processing, portfolio publishing, ESCO suggestions, matching, contact, messages and employer services.
• Legal obligation (6(1)(c)): accounting, tax and other mandatory retention and reporting duties.
• Legitimate interests (6(1)(f)): service security, abuse and fraud prevention, technical monitoring, legal claims, and verification of company and recommender data. Processing is limited to what is necessary.
• Consent (6(1)(a)): optional marketing and other clearly consent-based features. Marketing email requires separate, unticked consent and can be withdrawn at any time. Cookie marketing choices are not consent to email marketing.

Showing this privacy policy is not consent to processing required to perform a contract. Terms of use are accepted separately.

4. ESCO machine learning, profiling and human decisions

Text from a CV, profile or job post may be processed by the Duunijobs-managed ESCO service located in the EEA. Before transmission, common direct identifiers such as email addresses, phone numbers, links and contact rows are removed and text length is limited. Complete anonymisation is not promised because work and education history may itself be personal data.

The service suggests occupations and skills from the official ESCO classification. Suggested skills do not affect matching until the user confirms them. Fit is then calculated using predefined rules from confirmed occupation, skill, location and language information. The result is a recommendation and explanation, not a hiring or rejection decision. Employers decide on contact and recruitment; jobseekers decide whether to respond.

Processing may constitute profiling under the GDPR, but Duunijobs does not make solely automated decisions with legal or similarly significant effects. You can correct occupations and skills, reject suggestions, ask for an explanation and request human review. See how matching works.

5. Recipients and processors

Data is disclosed only as needed to parties such as:

• Vercel for application hosting and private file storage;
• Neon for the EEA-based PostgreSQL database;
• Duunijobs-managed ESCO services in Google Cloud’s Finland region and the European Commission ESCO API;
• Resend for email, Twilio for SMS if used, and Sentry for error monitoring if used;
• Stripe for employer payments and YTJ/PRH for company checks;
• another service user only according to the platform’s visibility and contact rules.

Data-processing terms are used with processors. If data is processed outside the EEA, the transfer uses an applicable GDPR Chapter V mechanism, such as European Commission standard contractual clauses, with a transfer-risk assessment.

6. Retention

• account, profile, CV, photograph and ESCO data: while the account exists or until you delete it;
• browser session: up to 30 days unless you log out earlier;
• ESCO suggestion snippets and confirmations: with the profile, removed when the account is deleted unless law requires retention;
• payments, invoices and contracts: for the statutory accounting or other mandatory period;
• security, abuse-prevention and governance logs: only for the necessary monitoring, verification and legal-claim period, then deleted or anonymised;
• marketing-email consent and withdrawal history: while consent is valid and then in limited form to demonstrate consent and handle legal claims.

Retention periods are reviewed regularly. Data is deleted or anonymised when there is no longer a legal basis.

7. Your rights

You may have the right to access, correct or erase data, restrict processing, object to legitimate-interest processing, receive data you provided, and withdraw consent. You may also request information about matching logic and human review. Send requests to support@duunijobs.fi. We may verify your identity before responding.

You can delete your account in settings. Deletion covers the CV, profile, and suggested, confirmed and rejected ESCO skills and related text snippets. Payment, contract or legal-claim data may be retained in limited form where required by law.

You may complain to the Office of the Data Protection Ombudsman in Finland: tietosuoja.fi.

8. Security and cookies

We use access controls, encrypted connections, private file storage, logging, backups and data minimisation. Personal-data breaches are assessed and notified under GDPR Articles 33–34 when required.

The service uses a necessary HTTP-only session cookie for login. See the cookie policy.

With analytics consent, Duunijobs may create aggregate click and scroll maps for public pages. Form contents, keystrokes, CV data and session video are not recorded. Logged-in dashboards, admin pages and API routes are excluded.

9. Changes

We update this policy if purposes, technology or recipients materially change. Material changes are announced in the service. The version and effective date appear at the top of this page.

See also the terms of use and the technical ESCO fit explanation.