Privacy Notice

Effective date: 29 September 2026. Version: 15.

1. Who is responsible

ArbeidMatch Norge AS, organisation number 935 667 089, provides recruitment and staffing services and operates RecOS. Our address is Sverre Svendsens veg 38, 7056 Ranheim, Norway. Contact post@arbeidmatch.no about personal data.

ArbeidMatch is the controller when handling its own recruitment, staffing, business contacts, platform account administration, billing and security. When a separate organisation manages recruitment in its own RecOS workspace, that organisation is normally the controller of those recruitment records and ArbeidMatch processes them on its instructions under a data processing agreement. The organisation must identify itself and provide its own recruitment privacy information. A workspace user is not automatically a separate controller.

Platform access does not authorize unrelated reuse of another organisation's recruitment records. Contact us if you need help identifying the responsible organisation.

2. Information and sources

Depending on the service, we process identity and contact information; CVs, experience, education, qualifications, languages and availability; applications and screening answers; recruitment communications, interviews and assessments; account and consent records; and technical information needed for security. Employment, identity, payroll and accounting documentation is collected only where needed for the relevant employment or legal obligation.

We receive information from you, the recruiter or organisation handling your application, authorised recruitment partners, references and business correspondence. Business contact details may also come from company websites and public business registers. Where information comes from another source, we provide the applicable privacy information, including the source, within the period required by GDPR Article 14: normally no later than one month, and earlier at first communication or disclosure where applicable.

Do not upload health information, criminal-record information, national identifiers or other unnecessary sensitive material in a general CV. Such information requires a specific necessity and applicable legal conditions; accepting our Terms does not provide those conditions.

For meetings we keep the participants' business contact details, time and location, replies and the follow-up summary.

3. Purposes and legal bases

We use recruitment information to assess experience, qualifications and availability, handle applications, communicate about recruitment and match people with relevant work. Recruitment-pool participation and the named-profile sharing described below rely on the relevant consent (GDPR Article 6(1)(a)). A specific application, future-opportunity contact, profile sharing and marketing are distinct purposes.

Article 6(1)(b) applies only where processing is necessary for a contract with the individual, or steps the individual requests before such a contract. A contract with an employer does not automatically provide this basis for every use of a candidate's or employee's information.

Our legitimate interests (Article 6(1)(f)) include securing accounts, preventing misuse, administering business relationships and arranging business meetings. We assess necessity and the impact on the person, and you may object. Optional visit statistics require consent. Electronic marketing is sent only where the applicable marketing rules permit it; a business email address is not a blanket exemption.

Article 6(1)(c) applies to specific employment, payroll, tax and accounting obligations where relevant. Any necessary special-category processing also requires an applicable Article 9 condition. We do not rely on a generic consent or an employer contract to bypass these requirements.

Acknowledging this notice or accepting the Terms is not consent to optional processing. Declining optional statistics or marketing does not prevent use of the core service. Without information needed for an application or without permission for a named presentation, the relevant recruitment step may not be possible.

4. Employers, clients and recruitment partners

A presentation may include occupation, skills, work history, qualifications, languages and availability. Removing a name does not necessarily make a profile anonymous: someone may still recognise the person from its details. We treat identifiable presentations as personal data.

For recruitment handled by ArbeidMatch, a full named profile, CV and contact details are released only with candidate permission covering that disclosure. Processing consent alone is insufficient. Registration does not give blanket permission to distribute a profile to any employer, partner or workspace. We check the recorded consent and retention deadline before releasing a named profile through our presentation controls.

Prospective employers and contracted recruitment or staffing partners receive information for the relevant recruitment purpose. Where a partner is involved, its role and the intended sharing must be explained to the candidate before disclosure. A recipient making its own recruitment decisions is responsible for its own lawful basis and privacy information. Recipients must protect profiles, restrict access and avoid unauthorised onward disclosure or unrelated reuse.

You may withdraw future sharing permission in candidate Privacy settings or by contacting post@arbeidmatch.no. Withdrawal does not undo earlier lawful sharing. We assess erasure and restriction requests and notify recipients where required. We cannot remotely erase every copy held by a separate employer, which may have its own legal obligations.

For references, provide professional contact details only after informing the referee and obtaining their agreement to be contacted. We use references for the relevant recruitment assessment; referees can contact us about their own information.

5. Other recipients and processing locations

Service providers support hosting, storage, communication, account operation and support. Where they act as processors, processing must follow documented instructions under data processing agreements. Professional advisers receive relevant information under confidentiality obligations. Authorities receive information when disclosure is required by law. A business reorganisation does not remove the requirement for a lawful basis, safeguards and appropriate information. We do not sell personal data.

Our recruitment records are configured for storage in the EU/EEA. A storage location is not a guarantee that every support, communication or connected-service operation occurs in that location. Processing locations and authorised service providers must be covered by the applicable agreements. Contact post@arbeidmatch.no for information about the recipients and safeguards relevant to your records.

Any transfer outside the EEA requires a lawful transfer mechanism, such as an applicable adequacy decision or standard contractual clauses with the necessary assessment and supplementary safeguards. You can request information about the mechanism and a copy of the relevant safeguards. A user's decision to connect a service does not by itself authorize an unlawful transfer.

6. Retention and deletion

We keep personal data only while necessary for its stated purpose or a specific legal obligation. Candidate self-registration and renewed self-service processing consent normally set a 365-day recruitment retention deadline. The recorded deadline is used by our named-profile sharing checks. A missing or expired deadline does not permit a named presentation. A new consent must be an actual new choice, not an automatic extension.

At expiry or withdrawal we restrict the affected recruitment use and review what must be deleted, what the person has validly asked us to keep, and any documented legal exception. Expiry of a consent record is not a claim that every associated document has already been erased. Erasure requests require checks of linked documents, recipient notifications and any narrowly applicable employment, accounting or legal-claim retention. Partial masking is not treated as completed erasure.

Accounting retention applies to the required accounting material, not automatically to an entire candidate dossier. Application records, correspondence and account data are reviewed against their continuing recruitment, support, security or legal need. Legal exceptions must have a purpose and end date; they do not permit continued marketing or recruitment sharing.

Optional pageview statistics have a 30-day retention policy, enforced by the scheduled retention process in bounded batches. Consent evidence is kept separately for up to two years under the current retention policy. Meeting invitations, replies and summaries are scheduled for deletion 12 months after the meeting. Backup and recovery copies must remain access-restricted and must not reintroduce erased data into active use.

7. Your rights

Subject to the applicable GDPR conditions, you can request access, correction, erasure, restriction and data portability. You can object to processing based on legitimate interests and object to direct marketing at any time. You can withdraw consent as easily as giving it, without affecting earlier lawful processing.

Use candidate Privacy settings where available, contact the organisation handling your recruitment, or write to post@arbeidmatch.no. We may request proportionate information to verify identity. We respond without undue delay and normally within one month. Where a lawful extension is necessary because of complexity or number of requests, we explain the reason within that first month.

You may complain to Datatilsynet, the Norwegian Data Protection Authority, at https://www.datatilsynet.no, or another competent supervisory authority. Using our service does not waive these rights.

8. Cookies, statistics and delivery records

Essential browser storage supports requested features and security. Our own optional visit statistics run only after an affirmative choice. Rejecting and accepting are available together, and Cookie settings lets you withdraw. Earlier acknowledgement of a cookie message is not reused as statistics consent. Neither site loads external analytics or advertising tags in this version.

Statistics include a coarse page category, referring website, approximate location and a daily visitor pseudonym. This is pseudonymous, not guaranteed anonymous, information. See the Cookie Policy at /cookies for storage names, durations, purposes and choice controls.

We record failed email delivery so addresses can be corrected. Personal invitation and presentation links can record opening times and responses to support the corresponding meeting or recruitment process. These operational records are distinct from optional general site statistics.

9. Security and automated assistance

We use access restrictions, authentication controls and protected connections to reduce unauthorised access and loss. Security measures must be maintained and reviewed; no website can promise absolute security.

Automated tools can assist with extracting professional information, matching and prioritising candidates or opportunities. Such outputs can be incomplete or wrong and require appropriate human review. Contact us to correct information, challenge an assessment or request human review of a decision affecting you. Processing that falls within GDPR Article 22 requires its applicable legal conditions and safeguards; ordinary acceptance of the Terms is not a waiver.

10. Children and changes

The service is not directed at children under 16. Contact us if information about a child has been submitted inappropriately so we can assess and remove it where necessary.

We publish the effective date and version of revisions and provide notice of material changes through the service or direct communication as appropriate. A revised notice does not retrospectively expand an existing consent. Previous versions are retained and available on request.