Last updated · 2026-08-26

Privacy policy

This page contains four privacy notices. Which one applies to you depends on your relationship with Staffer:

Each notice below is self-contained. Staffer.com AS, reg. no. 935 665 825, Tjuvholmen allé 1, 0252 Oslo, Norway, is the controller. Privacy enquiries: privacy@staffer.com. Where an employer runs its own recruitment process on the platform, that employer is the controller and Staffer acts as its processor; that processing is governed by the employer’s own privacy notice, not this one.

Notice 1: Portal candidates and applicants

This notice applies to you as a candidate who uses the Staffer portal, whether you registered to apply for a position or to create a profile to be found by employers. It explains how we process your personal data and the rights you have, under Article 13 of the GDPR. It covers the processing for which Staffer is the controller: your portal account and profile, your visibility to employers, and the career assistant. When you apply to an employer’s role through Staffer, that employer decides on your application and is the controller for its recruitment process; Staffer only processes your application on that employer’s behalf, and the employer’s own privacy notice covers that part.

Who is the controller?

Staffer.com AS, reg. no. 935 665 825, Tjuvholmen allé 1, 0252 Oslo, Norway. Privacy enquiries: privacy@staffer.com.

What data do we process?

  • Contact and login details: name, email, and authentication data
  • The CV, application, attachments and other documents you upload
  • Profile information: employment history, education and skills
  • Data generated during a recruitment process you take part in: your responses, test results where applicable, and communications
  • Usage data from the portal

How we collect your data

We collect this information directly from you: when you register, create or update your profile, upload documents, apply to a position, and as you take part in a recruitment process.

Special categories of personal data

We ask you not to upload or share special categories of personal data, for example data revealing health, trade union membership, religion, political opinions or ethnicity, unless it is strictly necessary for the position you are applying for. If you choose to include such data, for example in a CV or a free-text field, you do so on your own initiative and thereby ask us to process it as part of your application.

What we use the data for, and our legal basis

We process the data to provide the portal and to run the recruitment processes you take part in. Our legal basis is:

  • Performance of our agreement with you on the use of the portal and your candidate profile, under Article 6(1)(b).
  • Performance of that agreement when you register in order to be found by employers, because making your profile visible is then the very purpose of the service you have asked for, under Article 6(1)(b).
  • Your consent, under Article 6(1)(a), where we ask for it specifically: if you have applied for a particular position and also want to be visible as a candidate for other positions, we ask for a separate, voluntary consent. You can withdraw it at any time without affecting your ability to apply for positions.

Visibility to employers

If you create a profile in order to be found, being visible to employers who search for candidates is the purpose of the service, and that processing rests on our agreement with you. If instead you apply for a particular position, you can do so without making your profile visible to others; we then ask for a separate, voluntary consent only if you also want to be discoverable for other positions. In both cases you decide which data and documents are visible, and you can manage, pause or turn off your visibility in the portal at any time.

Career chat and AI

The portal offers an AI-based chat where you can get tips and advice on your profile and how to position yourself for different roles. You will always be told when you are interacting with an AI service. The chat log itself is private and is not shared with employers. If you use the chat to change, for example, your CV or profile, it is the changes you choose to save that become visible, not the conversation. We also use AI to assess how well your profile matches a position. This is decision support: a recruiter always makes the actual decision. You can ask for information about such an assessment and object to it.

Who we share the data with

We make your data available to the employers you apply to, and, where you have consented, to employers who search for candidates. Those employers are independent controllers for their own use of your data. We also use processors, for example cloud and AI service providers, who process data on our behalf under data processing agreements.

Is the data transferred outside the EEA?

Some of our providers are established outside the EEA, including in the United States. Where this happens, we safeguard the transfer using the European Commission’s Standard Contractual Clauses or another valid mechanism under Chapter V of the GDPR.

How long we keep the data

  • Your profile and the documents you upload are kept for as long as your account is active. We remind you periodically that we hold your data, and you can opt out at any time. If your account has been inactive for a long time, we reserve the right to delete or anonymise your profile.
  • Data relating to a specific recruitment process is normally deleted no later than six months after the process ends, unless you have consented to longer storage for future opportunities.
  • You can delete your profile yourself at any time, or ask us to do it.

Your rights

You have the right to access your data, to have inaccurate data corrected, to have your data erased, to restrict processing, to data portability, and to object to processing. Where processing is based on consent, you can withdraw that consent at any time. Contact us at privacy@staffer.com.

Notice 2: Sourced candidates

Applies under Article 14 of the GDPR, which governs the situation when we did not collect your data from you. Staffer helps employers find and hire people. Your professional profile is included in the database that Staffer makes searchable to employers, which means an employer may find your profile when recruiting for a role. This notice explains what we hold, why, and the choices you have, including how to be removed.

Who is responsible for your data

Staffer.com AS, reg. no. 935 665 825, Tjuvholmen allé 1, 0252 Oslo, Norway, is the controller of the sourced profile data described here. You can reach us at privacy@staffer.com.

What data we hold about you

We hold professional profile information: your name, work history, education, skills, professional location (region), a link to your public professional profile, and a profile photo where one is publicly available. We do not keep your contact details in the searchable database. If an employer decides to reach out to you, we retrieve a professional email address or phone number at that point, and delete it when it is no longer needed for that contact.

Where your data comes from

We obtain sourced profiles from a third-party data provider that compiles professional profiles from publicly available sources. We can tell you the name of the specific provider on request.

Why we process it, and our legal basis

We process your data to make professional profiles searchable to employers, to match and score profiles against the roles employers are recruiting for, and to let an employer contact you if your profile fits a role. Our legal basis is our legitimate interest, and the legitimate interest of the employers who use Staffer, in efficient recruitment (Article 6(1)(f) GDPR). We have assessed this interest against your rights and interests and documented that assessment. Because we rely on legitimate interest, you have the right to object at any time (see “Your choices and rights”).

Automated matching and scoring

We use automated processing, including profiling, to match and rank profiles against an employer’s role and to prioritise search results. This helps employers focus on relevant candidates. Any decision to contact you, to take you further in a process, or to reject you is taken by the employer’s own staff, not automatically by Staffer. If you want to understand how a score about you was reached, contact us and we will explain the logic involved.

Who your data is shared with

Your profile can be seen by employers using Staffer when they search for candidates. We also use service providers that process data on our behalf, for example hosting, search, and AI processing providers, and, when an employer reaches out, a contact-lookup provider. These providers act on our instructions under a contract. We do not sell your data.

International transfers

We process data primarily within the European Economic Area. Where a service provider processes data outside the EEA, we rely on an approved transfer mechanism, such as the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework, so that your data keeps an equivalent level of protection.

How long we keep it

We keep sourced profile data only for as long as it is relevant for recruitment matching, and we review what we hold. We remove your data promptly if you object or ask us to delete it. We do not keep contact details in the database; we retrieve them only when an employer decides to contact you and delete them when they are no longer needed for that purpose.

Your choices and rights

You have the right to:

  • ask for a copy of the data we hold about you (access);
  • have inaccurate data corrected (rectification);
  • have your data deleted (erasure);
  • ask us to restrict how we use it (restriction);
  • object to our processing at any time, because we rely on legitimate interest (Article 21). If you object, we will stop processing your data for these purposes unless we have compelling legitimate grounds that override your interests, which will rarely be the case for sourcing.

To exercise any of these, or to be removed from the database entirely, contact privacy@staffer.com. We will act on your request without undue delay. When we remove you, we also keep a minimal record so that a later data refresh does not re-add you.

You are not required to provide us with any data, and there is no consequence to you for objecting or asking to be removed.

Changes to this notice

We update this notice when our processing changes. The current version is always available on staffer.com.

Notice 3: Platform users

This notice applies to you when you use the Staffer platform on behalf of your employer, for example as a recruiter or hiring manager. It explains how Staffer processes personal data about you as a user, under Article 13 of the GDPR. The processing of candidate data and your employer’s content is governed separately, by the data processing agreement between Staffer and your employer.

Who is the controller?

Staffer.com AS, reg. no. 935 665 825, Tjuvholmen allé 1, 0252 Oslo, Norway. Privacy enquiries: privacy@staffer.com.

What data do we process about you?

  • Name, email address and job title
  • Login and authentication data (for example via SSO, LinkedIn or email)
  • Usage data: how you use the platform, actions and timestamps, logs
  • Communication with us (support, enquiries)

What do we use the data for, and on what basis?

We process the data to give you access to and provide the platform, administer your user account, ensure security and traceability, provide support, and improve and develop the service. The legal basis is:

  • Performance of the agreement between Staffer and your employer on use of the platform, and administration of your access as a user, under Article 6(1)(b) and (f).
  • Our legitimate interest in secure operation, troubleshooting, abuse prevention and product improvement, under Article 6(1)(f).

Who do we share the data with?

We use processors (for example providers of cloud, authentication and support services) who process data on our behalf under data processing agreements. We do not sell your data.

Is the data transferred outside the EEA?

Some of our providers are established outside the EEA, including in the United States. Where this occurs, we safeguard the transfer using the European Commission’s Standard Contractual Clauses (SCCs) or another valid transfer mechanism under Chapter V of the GDPR.

How long do we keep the data?

We keep your user data for as long as you have an active user account, and for a reasonable period after the account is closed to meet legal obligations and for security and traceability. Logs are retained in accordance with our internal security policies.

Your rights

You have the right to access, rectification, erasure, restriction, data portability and to object to processing based on legitimate interest. Contact us at privacy@staffer.com. Note that some rights may be limited by the fact that your access is administered by your employer.

Notice 4: Website visitors

This notice explains how Staffer handles personal data about people who visit staffer.com, contact us, request a demo, or subscribe to updates (together, “visitors”). It does not cover candidate data (see Notices 1 and 2 above), platform users acting for an employer (see Notice 3 above), or the candidate and content data an employer processes through the platform (governed by the data processing agreement between Staffer and that employer).

Who we are

Staffer.com AS, reg. no. 935 665 825, Tjuvholmen allé 1, 0252 Oslo, Norway, is the controller of the personal data described in this notice. Privacy enquiries: privacy@staffer.com.

Who this notice is for

This notice applies to you if you visit staffer.com or contact us, for example by submitting a contact or demo request, subscribing to updates, or emailing us. If you are a candidate, Notice 1 applies if you registered or applied, and Notice 2 if we found your profile through a third-party source. If you use the platform on behalf of an employer, Notice 3 applies.

What data we process

  • Contact and enquiry data you give us: name, work email, company, job title, and the content of your message or demo request.
  • Waitlist data you give us: your first name and email address, when you ask to be told that the candidate portal has opened.
  • Communications with us, including sales and support correspondence.
  • Technical and usage data about your visit: IP address, device and browser information, pages viewed, and similar, collected through cookies and similar technologies (see Cookies and similar technologies below).

Why we process it, and our legal basis

  • To respond to your enquiry or demo request and take steps at your request before entering a contract, under Article 6(1)(b), and our legitimate interest in responding to business enquiries, under Article 6(1)(f).
  • To tell you when the candidate portal opens, if you joined the waitlist, on your consent under Article 6(1)(a). You can withdraw that consent at any time by replying to any message we send you or by writing to privacy@staffer.com, and withdrawing it does not affect processing we carried out before you did.
  • To operate, secure and improve the website, under our legitimate interest, Article 6(1)(f).
  • To send you marketing about Staffer where we are permitted to (see Marketing communications below). Where we rely on consent, the basis is Article 6(1)(a); analytics and marketing cookies are set only with your consent.

Where we rely on legitimate interest, we have weighed our interest against your rights, and you can object at any time (see Your rights below).

Who we share it with

We use service providers (for example website hosting, analytics and communication providers) that process data on our behalf under data processing agreements and on our instructions. We do not sell your data. We may disclose data where the law requires it, or to establish, exercise or defend legal claims.

Cookies and similar technologies

We use strictly necessary cookies to run the website, and non-essential cookies (functional, analytics, marketing) only with your consent, collected through our cookie banner. Full details, including the cookie table and how to withdraw consent, are in our Cookie Policy.

Marketing communications

We send electronic marketing about Staffer only where we are permitted to under applicable marketing law, which as a rule requires your prior consent, with a limited exception for an existing customer relationship for our own similar services. Every marketing message includes a clear and working way to opt out, and you can opt out at any time by using the unsubscribe link or by contacting privacy@staffer.com.

International transfers

We process data primarily within the European Economic Area. Some of our providers are established outside the EEA, including in the United States. Where this occurs, we safeguard the transfer using the European Commission’s Standard Contractual Clauses, the EU-US Data Privacy Framework where the provider is certified, or another valid mechanism under Chapter V of the GDPR.

How long we keep it

We keep visitor enquiry data for as long as needed to handle your enquiry and our relationship with you, and for a reasonable period afterwards for our records and legal claims. We keep waitlist data until the candidate portal opens and we have told you, or until you ask us to remove you, whichever comes first. Data tied to cookies is kept for the periods set out in the Cookie Policy.

Your rights

You have the right to access the data we hold about you, to have inaccurate data corrected, to have data erased, to restrict processing, to data portability, and to object to processing based on legitimate interest (Article 21). Where we rely on consent, you can withdraw it at any time, which does not affect processing done before withdrawal. To exercise any of these, contact privacy@staffer.com.

Changes and contact

We update this notice to reflect changes to our services or the law, and the current version is always published on staffer.com. Questions: privacy@staffer.com.

Lodging a complaint

Whatever your relationship with Staffer, if you believe we have processed your personal data unlawfully you can lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, www.datatilsynet.no), or with the supervisory authority in your country of residence or work.