Cookie & Privacy Policy
Version 1.0 · March 2026 · Recruiting Rewards AB
Privacy Policy
Recruiting Rewards AB · Reg. no. 559257-2001
Kungsgatan 8, 111 43 Stockholm, Sweden
1. Introduction
1.1 Who we are
Recruiting Rewards AB (registration number 559257-2001) operates the platform recruitingrewards.com — a SaaS marketplace connecting Companies seeking candidates with Recruiters presenting qualified candidates. We are the data controller for the personal data processing described in this policy.
Address: Kungsgatan 8, 111 43 Stockholm, Sweden
Email: contact@recruitingrewards.com
1.2 Who this policy applies to
- Recruiters — individuals or companies registered on the platform to present candidates.
- Companies — organisations registered to post job listings and receive candidate presentations.
- Visitors — people who visit recruitingrewards.com without a registered account.
Note: Candidates whose details are presented via the platform are not direct users of the platform. A candidate's data protection relationship is primarily governed by the Recruiter presenting them — see Section 4.3.
1.3 Key definitions
- "Personal data" — any information that directly or indirectly identifies a living natural person.
- "Processing" — any operation carried out on personal data, such as collection, storage, use, or deletion.
- "Data controller" — the party that determines the purposes and means of processing.
- "Data processor" — a party that processes personal data on behalf of the data controller.
2. What personal data we collect
2.1 Data from Recruiters
- Identity data: name, email address, phone number.
- Professional data: current role, specialisation, geographic focus, career history (if provided).
- Account data: login credentials, account settings, subscription level.
- Billing data: bank account details or other payment information for reward payouts.
- Activity data: candidate presentations, communications with Companies, platform notes.
- Creator Profile data (qualifying plan): profile information you actively choose to publish to Companies.
2.2 Data from Companies
- Company data: company name, registration number, invoice address.
- Contact person data: name, email address, phone number, job title.
- Job listings: role descriptions, requirements and fee details.
- Billing data: payment details related to recruitment fees.
- Activity data: communications with Recruiters, notes, candidate status within the platform.
2.3 Candidate data
Candidate data is processed through the platform after a Recruiter presents them. Recruiting Rewards processes this data as a data processor on behalf of the Recruiter. Data may include:
- Name and contact details.
- CV, work history and educational background.
- Interview notes and qualification status.
- Status updates within the recruitment process.
Note: The Recruiter is responsible, as data controller, for obtaining the candidate's explicit consent before sharing their data via the platform.
2.4 Visitor data
When you visit recruitingrewards.com without being logged in, we automatically collect:
- Technical data: IP address, browser type, operating system, device type.
- Visit data: pages visited, time spent, referring website.
- Cookie data: see our Cookie Policy for full details.
3. Purposes, legal bases and retention
| Purpose | Data categories | Legal basis |
|---|---|---|
| Providing and operating the platform | Account and identity data | Contract (Art. 6.1b) |
| Managing the recruitment process | Activity data, job listing and candidate data | Contract (Art. 6.1b) |
| Invoicing and reward payouts | Billing data, transaction data | Contract + Legal obligation (Art. 6.1b/c) |
| Improving and developing the platform | Anonymised/aggregated usage data | Legitimate interest (Art. 6.1f) |
| Customer communication and support | Contact details, communication history | Contract + Legitimate interest (Art. 6.1b/f) |
| Sending product news and updates | Email address | Consent (Art. 6.1a) |
| Security and fraud prevention | Activity data, technical data | Legitimate interest (Art. 6.1f) |
| Compliance with legal obligations | Billing data, relevant transactions | Legal obligation (Art. 6.1c) |
| Defending legal claims | Relevant communications and activity data | Legitimate interest (Art. 6.1f) |
| Restructuring or acquisition | Limited business-relevant data | Legitimate interest (Art. 6.1f) |
3.1 Retention periods
- Account data: retained during the active account period and deleted within 90 days of account closure.
- Billing records: retained for 7 years in accordance with Swedish accounting law.
- Candidate data: retained during the recruitment process and deleted once concluded or upon request.
- Creator Profile data: deleted within 30 days of the qualifying subscription ending.
- Visitor logs: retained for a maximum of 12 months.
- Marketing communications: retained until unsubscription.
4. Data protection roles and responsibilities
4.1 Recruiting Rewards as data controller
Recruiting Rewards AB is the data controller for processing of Recruiters' and Companies' account and profile data, visitor and technical data, and the platform's own communications with users.
4.2 Recruiting Rewards as data processor
For candidate data uploaded by Recruiters, Recruiting Rewards acts as a data processor on the Recruiter's behalf. A Data Processing Agreement (DPA) is available on request.
4.3 The Recruiter's responsibility as data controller
The Recruiter is an independent data controller for their processing of candidate data. The Recruiter is responsible for:
- Obtaining the candidate's explicit consent before sharing their data via the platform.
- Informing the candidate of the purpose of processing and who receives their data.
- Ensuring that the data is accurate, relevant and up to date.
- Processing data in accordance with the GDPR and applicable national data protection law.
Note: Recruiting Rewards is not responsible for the Recruiter's processing of candidate data.
4.4 The Company's responsibility
The Company is responsible for its handling of received candidate information and must not use the data outside the specific recruitment purpose.
5. Sharing personal data
5.1 Sharing within the platform
- Recruiter profile information (where published via the Creator feature) is visible to Companies.
- Candidate data that a Recruiter presents is shared with the relevant Company.
- Job listing content is visible to Recruiters on the platform.
5.2 Sub-processors and service providers
We share personal data with trusted providers including: cloud infrastructure and hosting, payment processing and invoicing, analytics tools (anonymised), and email communication services. All sub-processors are bound by data processing agreements.
5.3 International transfers
Where sub-processors are outside the EU/EEA, we ensure appropriate safeguards are in place, such as EU Standard Contractual Clauses (SCCs) or European Commission adequacy decisions.
5.4 Authorities and legal requirements
We may disclose personal data to authorities where legally required, disclosing only the minimum necessary.
5.5 Business transfers
In the event of a merger or acquisition, personal data may transfer to the new owner under equivalent privacy protections. Users will be informed in advance.
We never sell personal data to third parties.
6. Your rights under the GDPR
- Right of access (Art. 15): receive a copy of your personal data.
- Right to rectification (Art. 16): correct inaccurate or incomplete data.
- Right to erasure (Art. 17): request deletion under certain conditions.
- Right to restriction (Art. 18): request restricted processing in certain situations.
- Right to object (Art. 21): object to processing based on legitimate interest.
- Right to data portability (Art. 20): receive your data in a machine-readable format.
- Right not to be subject to automated decision-making (Art. 22): not to be subject to solely automated decisions with legal effects.
- Right to withdraw consent: withdraw at any time without affecting prior processing.
To exercise your rights, contact contact@recruitingrewards.com. We respond within 30 days (up to 90 days for complex requests with notice).
7. Security and incident management
7.1 Technical and organisational measures
We implement:
- Encrypted data transmission (TLS/HTTPS).
- Access controls based on least privilege.
- Regular security reviews.
- Restricted data access for authorised personnel only.
7.2 Security incidents
In the event of a personal data breach:
- We notify IMY within 72 hours.
- Inform affected individuals where high risk is identified.
- Take immediate steps to contain the incident.
9. Minors
The platform is not directed at persons under 18. We do not knowingly collect data from minors. Contact contact@recruitingrewards.com if you believe data relating to a minor is in our systems.
10. Complaints and supervisory authority
Swedish Authority for Privacy Protection (IMY)
Email: imy@imy.se
Website: www.imy.se
Users in other EU member states may contact their local supervisory authority. We encourage you to contact us first at contact@recruitingrewards.com.
11. Changes to this policy
We may update this policy from time to time. The latest version is always at recruitingrewards.com. Material changes are communicated via email or platform notification before taking effect.
12. Contact
Recruiting Rewards AB
Registration no.: 559257-2001
Kungsgatan 8, 111 43 Stockholm, Sweden
Email: contact@recruitingrewards.com
Website: recruitingrewards.com
© 2026 Recruiting Rewards AB. All rights reserved.