This policy explains what personal data CDRjobs collects, why, on what legal basis, for how long, and what your rights are. It is written to meet Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”).
Data controller
The controller is CDRjobs OÜ, a private limited company registered in Estonia under registry code 17455087, with its registered office at Narva mnt 5, 10117 Tallinn, Estonia (“CDRjobs”, “we”, “us”). For any question about your data, write to info@cdrjobs.earth.
Scope
This policy covers:
- the website cdrjobs.earth (the “Website”), including its job board, newsletter, salary report and partnership forms;
- the application app.cdrjobs.earth (the “App”), where Premium subscribers manage their account, alerts, saved jobs and CV;
- the CDRjobs job boards embedded on the websites of partner organisations (the “Embedded Boards”), which are operated by CDRjobs inside those websites;
- the emails we send you.
“You” means any visitor or user of these Services. The Terms of use describe the Services themselves.
Changes to this policy
We update this policy when the Services or the law change. The date at the top of this page shows the current version. Premium subscribers are told by email of changes that materially affect them.
What we collect and why
Each activity below lists the data involved, the purpose, the legal basis under Article 6 GDPR, and whether providing the data is required.
Visiting the Website, the App or an Embedded Board
Data. Server logs: IP address, date and time, requested page, browser and operating system. Anonymous usage events: pages viewed, searches and filters used, jobs displayed or clicked, the address of the page hosting an Embedded Board. No cookie or persistent identifier is stored in your browser for this measurement (see the cookies section).
Purpose. Keep the Services running securely (rate limiting, abuse detection, troubleshooting) and understand how they are used in aggregate.
Legal basis. Our legitimate interest in operating and improving the Services.
Retention. Server logs: up to 30 days. Anonymous usage events: not linked to you.
Your account
Data. Name, email address, password (stored as a hash) or one-time sign-in links, sign-in sessions (IP address, browser, dates), account settings.
Purpose. Create your account when you subscribe, sign you in, secure your account, contact you about it.
Legal basis. Performance of the contract between you and CDRjobs (the Terms of use). Required: without it we cannot provide an account.
Retention. For as long as your account exists. Sessions expire after a short period and expired sessions and sign-in links are erased. Accounts with no active subscription and no sign-in for 24 months are deleted after an email notice. When you delete your account we keep a record of the deletion: its date, the age of the account, whether a subscription and a CV existed, and a keyed hash of your email address that lets us find this record if you write to us about the deletion. The hash is erased after 3 years; the rest is anonymous.
Subscription and payment
Data. Your Stripe customer identifier, subscription status and dates, the country and, where you give it, the billing details you enter on the Stripe payment page. Your card details are entered on a page hosted by Stripe and never reach our servers.
Purpose. Take payment, manage renewals, cancellations and refunds, issue invoices, keep the accounts that the law requires.
Legal basis. Performance of the contract; compliance with our legal obligations (accounting and tax law).
Retention. Subscription records and invoices are kept for 7 years after the last invoice, as required by Estonian accounting law, including after you delete your account.
Job preferences and email alerts
Data. The criteria you set: fields of work, contract types, seniority, work modes, city of residence, cities or countries you would relocate to, time zone, alert frequency. The history of the alerts we sent you (dates and jobs included).
Purpose. Select the jobs that match you, send your email alerts, open the App on your criteria, and avoid sending the same job twice. Your criteria also feed, in aggregate and without identifying you, the statistics described under “Aggregate statistics” below.
Legal basis. Performance of the contract; our legitimate interest in understanding the CDR job market for the aggregate statistics. Providing criteria is required for alerts; the city of residence is optional.
Retention. For as long as your account exists.
Saved jobs and feedback
Data. The jobs you save, the ratings (useful or not) and comments you give on salary estimates and CV advice.
Purpose. Show your list, improve the CV advice with the jobs you care about, improve the Services.
Legal basis. Performance of the contract (saved jobs); our legitimate interest in improving the Services (feedback). Optional.
Retention. For as long as your account exists.
Your CV and CV advice
Data. The CV file you upload (PDF) or the text you paste, the text we extract from it, a target profile derived from it by an AI model (title, seniority, skills, responsibilities), a numerical representation of that profile used to compare it to jobs, the advice generated, and the dates and number of generations.
Purpose. Generate advice on your CV against the roles you target and the jobs you saved.
How it works. The extracted text of your CV, your criteria and the jobs concerned are sent to Anthropic (Claude models) to produce the profile and the advice, and to OpenAI to compute the numerical representation. Both act as our processors under their API terms: they do not use your data to train their models and keep it only for the time needed to answer, plus a short period for abuse monitoring. No human at CDRjobs reads your CV, except at your request for support.
Legal basis. Performance of the contract, at your initiative. A CV may contain sensitive information (for example health, religion or trade union membership). Please remove anything that is not needed for the advice. Where you leave such information in, we process it only because you have deliberately made it part of the CV you submit for this purpose (Article 9(2)(a) GDPR), and you can remove it at any time by uploading a new CV.
Retention. Your CV cannot be deleted separately from your account: uploading a new one replaces it. We erase your CV, the derived profile and the advice when you delete your account, and at the latest 12 months after your subscription ends.
Salary estimates
The estimated salary ranges shown on jobs are computed from the job descriptions and public market data. They are not based on your personal data. Only your viewing them is recorded as a usage event (see below).
Usage measurement in the App
Data. Events describing what you do in the App: pages opened, searches, filters, jobs viewed or saved, alerts received, features used, with their dates.
Purpose. Understand how subscribers use the App, measure which features matter, improve them, and produce the statistics described under “Aggregate statistics” below.
Legal basis. Our legitimate interest in improving the Services. You can object at any time with the “Usage analytics” switch in the Settings page of the App: from then on your events are recorded without any link to you, and the events already recorded are detached from your account.
Retention. Linked to your account for 12 months, then anonymised, or as soon as you object or delete your account.
AI usage log
Data. For each call to an AI provider made for you (CV advice): the feature, the model, the number of tokens, the cost, the duration and the outcome. Not the content.
Purpose. Detect abuse of the AI features and control their cost. This log is kept even if you object to usage measurement, because its purpose is different.
Legal basis. Our legitimate interest in preventing abuse and controlling costs.
Retention. Linked to your account for 12 months, then anonymised, or as soon as you delete your account.
Support
When you write to us, we keep the correspondence to answer you and to keep a record of the request. To investigate a problem with your account, a member of our team may sign in to the App as you; this access is logged. Legal basis: performance of the contract and our legitimate interest in providing support. Retention: 24 months after the last exchange.
Newsletter
Data. Email address, first and last name, subscription date, and whether you open the emails.
Purpose. Send you the CDRjobs newsletter (job listings, company profiles, industry insight).
Legal basis. Your consent, given by ticking the box in the subscription form. You can withdraw it at any time with the unsubscribe link in each email or by writing to us.
Retention. Until you unsubscribe, or 24 months after you last opened one of our emails.
Deleting your App account does not unsubscribe you from the newsletter, which rests on a separate consent: use the unsubscribe link in any newsletter email.
Salary report
Data. Email address, first and last name, and whether you also asked for the newsletter.
Purpose. Email you the salary report you asked for.
Legal basis. Your request (steps taken at your request before entering into a contract) for the report; your consent for the newsletter, if ticked.
Retention. 24 months.
Partnership requests (employers)
Data. Company name, website and address, first and last name, email address, the plan and billing cadence chosen, the legal representative’s name and the VAT or tax number.
Purpose. Process your request to join the Partnership Programme and prepare the agreement and invoicing.
Legal basis. Steps taken at your request before entering into a contract; then performance of that contract and our legal obligations.
Retention. 24 months after the request is handled, or, where a contract follows, 7 years after its last invoice.
Emails we send you
Account emails (sign-in links, email verification, password reset), job alerts, subscription notices, the newsletter and the salary report are sent through Brevo, our email provider. Alert and newsletter emails record whether they were opened; account emails do not.
Location search
When you type a city in a location field, the text you type is sent to Mapbox through our servers to suggest places. Mapbox does not receive your identity.
Aggregate statistics
We may produce and publish statistics about the Services and the carbon dioxide removal job market: for example the fields of work, locations and seniority levels that candidates look for, or how the job boards are used. They are computed from the job preferences and the usage events described above, together with the job listings themselves, and are only ever aggregates: no figure is published for a group so small that a person could be recognised, and no individual record is ever shared. Such statistics are anonymous and are not personal data. Your CV, the profile derived from it and the CV advice are never used for them.
Legal basis. Our legitimate interest in understanding and documenting the CDR job market. Producing anonymous statistics from data we already hold is a compatible further use under Article 5(1)(b) GDPR. You can object to the use of your data for this purpose as described under “Your rights”.
Who receives your data
We do not sell personal data. It is shared only with the service providers below, which process it on our instructions under a data processing agreement, and, where required, with the authorities.
- Render (hosting of our servers and database, Frankfurt, Germany).
- Stripe (payments; Stripe Payments Europe Ltd, Ireland, and Stripe Inc., United States). Stripe is an independent controller for the payment data it collects on its own pages.
- Brevo (email sending and newsletter contacts, France).
- Anthropic (AI models for CV advice, United States).
- OpenAI (AI models for matching your profile to jobs, United States).
- Mapbox (place suggestions, United States).
- Amplitude (anonymous usage measurement of the Website and Embedded Boards, data stored in the European Union).
- Our accountants and legal advisers, where needed.
- A successor of our business, in the event of a merger, sale or reorganisation; you would be told.
Partner organisations that embed a CDRjobs board on their website do not receive personal data from us about your use of it.
Transfers outside the European Economic Area
Our servers and database are in the European Union. Some of the providers above are established in the United States or may process data there (Stripe, Anthropic, OpenAI, Mapbox). For those transfers we rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and otherwise on the Standard Contractual Clauses approved by the Commission (Article 46(2)(c) GDPR), with additional safeguards where needed. You can ask us for a copy of the relevant clauses.
How long we keep your data
The retention period of each category is given above. In short:
- account, preferences, saved jobs, feedback: for as long as your account exists, deleted with it; inactive accounts (no subscription, no sign-in for 24 months) deleted after notice;
- CV, derived profile and advice: deleted with your account, or at the latest 12 months after your subscription ends;
- subscription and invoicing records: 7 years after the last invoice;
- record of an account deletion: 3 years for the email hash, then anonymous;
- usage events and AI usage log: linked to you for 12 months, then anonymised;
- newsletter: until you unsubscribe or after 24 months without opening; salary report and support requests: 24 months; partnership requests: 24 months after handling;
- server logs: 30 days.
Deleted data may remain in our database backups for up to 30 days before being overwritten.
Automated decisions
Salary estimates, the matching of jobs to your criteria, and CV advice are produced automatically. None of them is a decision with legal or similarly significant effects on you: they are suggestions, and every decision about an application is yours and the employer’s. Article 22 GDPR therefore does not apply.
Security
Data is transmitted over HTTPS and stored in an encrypted database. Passwords are hashed. Access to production systems is restricted to our team and logged. Automated features are rate-limited per account and per IP address. No system is perfectly secure; if we learn of a breach affecting your data we will tell you and the supervisory authority as the GDPR requires.
Your rights
Under Articles 15 to 22 GDPR you have the right to:
- access the personal data we hold about you and obtain a copy;
- have inaccurate data corrected and incomplete data completed;
- have your data erased, where the GDPR allows it;
- restrict the processing of your data in certain cases;
- receive the data you gave us in a structured, machine-readable format, and have it transmitted to another controller where technically feasible;
- object at any time to processing based on our legitimate interests, including usage measurement;
- withdraw your consent at any time, without affecting the processing done before the withdrawal.
Several of these are available directly in the App: change your name, email and criteria in Settings, switch off usage measurement, switch off alerts, and delete your account. For everything else, write to info@cdrjobs.earth from the email address of your account; we answer within one month.
You also have the right to lodge a complaint with a supervisory authority, in particular the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee, Tatari 39, 10134 Tallinn, info@aki.ee) or the authority of the country where you live or work.
Children
The Services are not intended for anyone under 18 and we do not knowingly collect data about children. If you believe a child has given us personal data, tell us and we will delete it.
Cookie policy
Cookies are small files that a website stores in your browser. We use as few as possible.
Cookies we set
- Session cookie of the App (on app.cdrjobs.earth and, when you sign in there, the Website): keeps you signed in. Strictly necessary, no consent required. Expires after a short period of inactivity, or when you sign out.
The Website, the public job board, the Embedded Boards and the subscription funnel set no analytics or advertising cookie. Our usage measurement of these pages works without storing any identifier in your browser, and it cannot recognise you between visits.
Cookies set by others
- Stripe, on its payment page and through the fraud-prevention script it loads during checkout, sets cookies to secure the payment. They are necessary to pay and are governed by Stripe’s privacy policy.
Because we set no cookie that requires consent, the Website shows no cookie banner. If this changes, we will ask for your consent before setting such cookies.
Managing cookies
You can delete or block cookies in your browser settings (Chrome, Firefox, Safari, Edge). Blocking the session cookie prevents you from signing in to the App.
Contact
CDRjobs OÜ, Narva mnt 5, 10117 Tallinn, Estonia. Registry code 17455087. Email: info@cdrjobs.earth.