Privacy Policy
Last updated: June 2026 — Compliant with GDPR (EU) 2016/679
1. Who is responsible for your data?
CarlaGo is a recruitment and sales management platform (SaaS) operated by its platform owner. Each organisation (company) that uses CarlaGo to manage its recruitment processes acts as the Data Controller for the personal data of their applicants and contacts. CarlaGo acts as the Data Processor on behalf of those organisations.
If you have questions about how your data is handled by a specific organisation using CarlaGo, please contact that organisation directly. For questions about the platform itself, contact: privacy@carlago.se.
2. Personal data we process
Applies to applicants and candidates managed through the platform.
| Category | Examples |
|---|---|
| Identity data | First name, last name |
| Contact data | Email address, phone number, city |
| Professional data | Current employer, job title, experience, education, CV, LinkedIn URL, portfolio URL |
| Skills & competences | Skill names and proficiency levels, language skills (Swedish, English, other) |
| Application data | Cover letter, applied position, application status, internal recruiter notes |
| Interview data | Interview stage, scheduled date/time, interviewer name, outcome notes |
| Candidate pool data | Candidate priority, salary expectation, availability, work preferences (hybrid/relocation), references, responsible seller |
| Consent & communication | Email correspondence history, date consent was last renewed |
| Platform users | Name, email, hashed password, role within the organisation |
3. Legal basis for processing
- Contract performance (Art. 6(1)(b)) — when an applicant has applied for a specific position and processing is necessary to evaluate and progress that application.
- Legitimate interest (Art. 6(1)(f)) — for internal notes, history logging, and coordination between recruiters during an active recruitment process.
- Consent (Art. 6(1)(a)) — when an applicant is added to the candidate pool (status: KandidatPool – Ready) and retained beyond the active recruitment. Consent is requested at entry and renewed automatically every 12 months via an email containing a personal link to confirm or withdraw. Withdrawing consent at any time, via that link, results in immediate removal from the candidate pool.
- Legal obligation (Art. 6(1)(c)) — where retention is required by applicable Swedish or EU law.
4. How long we keep your data
| Data type | Retention period |
|---|---|
| Active application data | Until the recruitment process is concluded, then anonymised or deleted |
| Rejected applicants | Up to 6 months after rejection, unless a shorter period is requested |
| Candidate pool (KandidatPool – Ready) | Up to 12 months from last consent. A renewal consent email is sent automatically every 12 months, with a link valid for 30 days. If it is not confirmed within that window, the record is automatically taken out of the active candidate pool. |
| Uploaded files (CV, documents) | Same as the associated applicant record |
| Platform user accounts | Until the account is deactivated or the organisation ends its subscription |
5. How we use your data
- Evaluating job applications and managing the recruitment pipeline
- Scheduling and recording interviews
- Maintaining a talent pool of pre-qualified candidates for future roles
- Sending notifications relevant to your application (interview invitations, status updates, consent renewals)
- Internal coordination among recruiters and hiring managers within the organisation
- Audit trail and history for compliance purposes
6. Who we share your data with
Your personal data is not sold to third parties. Access is limited to:
- Authorised staff of the organisation managing the recruitment (recruiters, interviewers, admins)
- Email delivery provider — used solely to transmit notification emails to you (transactional email only)
- Hosting infrastructure — the servers where CarlaGo runs and where data is stored
- All sub-processors are bound by data processing agreements and GDPR-compliant terms
7. Your rights under GDPR
You have the following rights regarding your personal data. Requests should be directed to the organisation that collected your data (the Data Controller).
You can request a copy of all personal data held about you.
You can request correction of inaccurate data.
You can request deletion of your data ("right to be forgotten"), subject to legal retention obligations.
You can request that processing of your data is limited in certain circumstances.
You can request your data in a structured, machine-readable format.
Where processing is based on consent (e.g. candidate pool), you can withdraw at any time without affecting prior processing.
You can object to processing based on legitimate interest.
You have the right to lodge a complaint with the Swedish supervisory authority: IMY (Integritetsskyddsmyndigheten).
8. Security measures
We take appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss, or destruction.
- Data is transmitted using encrypted connections.
- Access to personal data is restricted to authorised users who require it to perform their duties.
- Security controls are implemented to protect user accounts and personal information.
- Customer data is logically separated to prevent unauthorised access between organisations.
- Administrative and audit records are maintained to support security, compliance, and troubleshooting.
9. Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects when the most recent changes were made. Continued use of the platform after changes are posted constitutes acceptance of the updated policy.
10. Contact us
For privacy-related requests or questions about this policy, contact: privacy@carlago.se