Recruitment privacy notice
This notice explains how we process personal data when you apply for a role through growthforge.biz/careers. Our general privacy policy covers everything else on this website.
1. Who is responsible
Growthforge OÜ
Tartu mnt 67/1-13b, Kesklinna linnaosa, 10115 Tallinn, Harju maakond, Estonia
Registry code 17354222, VAT ID EE102915365
Email: office@growthforge.biz
We have not appointed a data protection officer. For privacy questions, data requests and help with the application, write to the address above. Please do not send applications by email.
2. What we collect
Required: your name, email address, country of residence, time zone, earliest start date, whether you can work full-time (and if not, how many hours per week), expected monthly gross compensation in EUR, preferred engagement type, relevant experience band, a short real example of supervising an AI agent, your CV as a PDF file and your confirmation that you have read this notice.
Optional: phone number, portfolio or LinkedIn link, tools you use and how you heard about the role.
Assessment: the role you chose, the questions you were shown and their order, the answers you selected with timestamps (including how familiar you are with a list of tools and terms), your confirmation that you answered on your own, the time you started and submitted, the scores our server calculates from your answers and the results of the checks described in section 4.
Video step (if invited): the Google Drive or Dropbox link you send us, every corrected link, our notes on whether the link worked when we opened it, the duration we observed and our ratings of the video.
Reviewer records: the review status of your application, notes and decisions by the people who review it, with their name and time.
Technical data: a session cookie while you apply (section 8) and the connection data our hosting provider processes for every request, such as your IP address, for delivery, security and rate limiting.
We do not ask for a photo, date of birth, age, nationality, home address, identity documents or a rating of your English. You do not need to include them in your CV either. Please do not send information about your health, religion or other special categories of data.
3. Why we process it and on what legal basis
We use your data to assess your application, to contact you about it and to decide whether to make you an offer. The legal basis is Art. 6(1)(b) GDPR, steps taken at your request before entering into a contract. We use technical data and keep reviewer records to run the application securely and to document our decisions, based on our legitimate interest under Art. 6(1)(f) GDPR. Giving us the required information is necessary to apply. Without it we cannot consider your application.
4. How the assessment and triage work
The assessment starts with a short list of tools and terms, where you tell us how familiar you are with each, followed by 32 multiple-choice questions on working with AI agents, the role, project judgement and everyday work situations. The questions about work situations help us understand how you approach typical situations in the role. Please answer on your own, without AI assistants or help from another person. Our server scores your answers and uses the result to sort applications into review queues. Applications with a high result are invited to the video step straight away.
To keep the process fair, we check answers for signs of AI assistance and for consistency. Such a sign only means that a person looks at your application before the video step and may ask you about it in a conversation. It never rejects an application on its own.
A person reviews every application, including those with lower results. A score never rejects you and never leads to an offer on its own. Reviewers can invite anyone to the next step, and they consider your CV, your answers to the form and the video as well. The scoring settings are a pilot and are reviewed by people. We do not use proctoring, camera checks, tab tracking or a hard time limit, and we do not use AI to read your CV or to rate you.
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). If you would like a person to explain or reconsider how your application was handled, write to office@growthforge.biz.
5. Your CV
Your CV is stored as the file you uploaded. We check that it is a readable PDF of at most 4 MB without a password, and we do not extract, analyse or score its content automatically. Only authorised reviewers can download it, through a protected page.
6. Video links
The video stays on your own Google Drive or Dropbox account and under your control. We store only the link you send us. A reviewer opens it in a browser to watch it and to check that it plays without signing in. We do not download, embed, transcribe or automatically analyse the video, and we do not assess your accent, appearance, background or equipment. We rate how clearly you explain, how well your answer is structured, how you explain a decision and how specific your example is. Whether the sharing link worked is noted separately.
Google and Dropbox process your video under their own terms and privacy policies. You can remove sharing once the application process has ended. Deleting your application from our system removes the link we stored. It does not delete the video from your Google Drive or Dropbox account.
7. Where your data is stored and who receives it
- Netlify, Inc. (USA) hosts this website and runs the application, including storage of your details, CV and assessment in its Netlify Blobs service in the EU region (Frankfurt), under a data processing agreement.
- Google Workspace (Google Ireland Limited, Ireland, and Google LLC, USA) handles our email if we write to you or you write to us, under a data processing agreement.
- The people at Growthforge who review applications. We do not sell your data and do not pass it to other employers or recruiters.
- Professional advisers and authorities where we are legally required or entitled to share data.
Netlify and Google may access data from the USA. Such transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). We do not send your data to an AI provider.
8. Session cookie and private links
While you apply, the server sets one strictly necessary session cookie
(__Secure-gf-careers) so that you can continue where you left off. It cannot be read by
scripts on the page, it is only sent to our application, and it expires after 72
hours. We set no analytics or advertising cookies and store nothing else in your browser.
When you start, you get a private link to continue later on any device. It is valid for 72 hours, and you can create a new one while you are signed in. Video invitations from our reviewers work the same way. Anyone who has the link can open your application, so keep it private. Creating a new link makes the previous one stop working.
9. How long we keep your data
- Submitted applications, with CV, assessment, video links and reviewer records: 180 days after submission.
- Unfinished applications that were never submitted: 7 days after your last change.
- If we hire you, the documents we need for your contract move to our personnel records and the rules for those apply.
- If you would like us to keep your application for future roles, we will ask for your consent separately.
Deletion is not automatic yet. We delete data that has reached these periods with a documented cleanup procedure that a person runs regularly, at least once a month. You can ask us to delete your application earlier at any time.
10. Your rights
Under the GDPR you have the right to:
- access the data we hold about you (Art. 15),
- have inaccurate data corrected (Art. 16),
- have your data erased (Art. 17),
- restrict processing (Art. 18),
- receive your data in a portable format (Art. 20),
- object to processing based on our legitimate interests (Art. 21),
- obtain human intervention, express your point of view and contest a decision (Art. 22(3)).
To exercise your rights, email office@growthforge.biz and include your reference number if you have one. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work. The authority responsible for us is:
Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)
Tatari 39, 10134 Tallinn, Estonia
www.aki.ee, info@aki.ee
11. Changes
We update this notice when our recruitment process changes. The current version is always available at this address.