Privacy policy

01

Data controller and contact

HourCrew is the data controller for the processing described in this policy. In a specific staffing or recruitment assignment, HourCrew and the client company may each act as an independent controller for their own purposes.

02

Personal data we process

The data we process depends on how you interact with us. We apply data minimisation and ask you not to send sensitive information unless it is expressly requested and necessary.

• Contact and enquiries: name, email address, phone number, employer, role, location, message, and correspondence.
• Candidates and applications: CV, employment history, education, skills, preferences, interview notes, and other information supplied in an application.
• Matching and checks: assessments, references, and relevant checks where permitted, proportionate, and necessary. Special categories and criminal-record information are processed only where legally supported and with separate information where required.
• Website and security: IP address, timestamp, requested page, technical headers, and device or browser information that may appear in operational and security logs held by our hosting provider.
• Local browser storage: your acknowledgement of the cookie notice. The intro animation does not use persistent browser storage. See the cookie policy for the complete inventory.

Data normally comes from you. In recruitment, relevant information may also come from referees, client companies, or professional public sources. Where data is collected from another source, we provide information as required by applicable law.

03

Purposes and legal bases

Where we rely on legitimate interests, we carry out a balancing assessment. The website does not use personal data for targeted advertising and does not make significant decisions based solely on automated processing.

04

Who receives the data?

Access is limited to what is necessary. Data may be shared with authorised HourCrew personnel, client companies in a relevant match, Vercel for website hosting, Resend for secure delivery of form messages, other necessary IT providers, professional advisers, and public authorities where required by law. Candidate data is not shared with a client company outside a relevant assignment without informing the candidate.

Transfers outside the EU/EEA

The website is hosted by Vercel and form messages are delivered through Resend. The providers may process relevant technical data and message data in the United States and other countries. Where personal data is transferred outside the EU/EEA, a valid transfer mechanism is used, such as an EU adequacy decision, the EU–US Data Privacy Framework for certified recipients, or the European Commission's Standard Contractual Clauses with supplementary safeguards where required. Contact us for more information about applicable safeguards.

05

How long is data retained?

We retain personal data only for as long as needed for its purpose and afterwards where required by law, contract, or legal claims. The following guidelines apply:

• General enquiries and correspondence: normally no more than 24 months after the interaction ends, unless they form part of an ongoing client or contractual relationship.
• Applications for a specific role: normally no more than 24 months after the process ends, including to address questions or legal claims.
• Talent pool: no more than 24 months from consent or its latest renewal; data is then deleted or fresh consent is requested.
• Contract and accounting records: for the duration of the relationship and afterwards for the period required by law; accounting records are normally kept for seven years.
• Technical logs: in line with the hosting provider's security and retention settings and no longer than necessary for operations, troubleshooting, and security.

When data is no longer needed, it is securely deleted or anonymised.

06

Your rights under the GDPR

Depending on the circumstances, you may request information and access, correction, erasure or restriction, object to processing based on legitimate interests, and receive data in a portable format where the conditions are met. You may withdraw consent at any time without affecting processing carried out before withdrawal.

Send your request to recruit@hourcrew.com. We may need to verify your identity and normally respond within one month. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

07

Security and automated decisions

HourCrew uses appropriate technical and organisational measures to protect data against unauthorised access, alteration, loss, and unlawful disclosure. Access is limited by need and providers are subject to relevant data-protection requirements.

HourCrew does not use solely automated decisions that produce legal or similarly significant effects for candidates. Matching and selection involve human assessment.

08

Cookies, updates, and questions

The website's essential storage is described in our cookie policy. If processing changes, we update this policy and the date shown above. We provide more prominent notice of material changes where appropriate.

Questions about this policy or how your data is processed should be sent to recruit@hourcrew.com.