How we handle your details.
Short version: you send us a message, two people read it, we answer, and we keep it only as long as we need to. No cookies, no tracking, no analytics on this site, and nothing loaded from anywhere but the site itself. Last updated 18 September 2026.
Lühidalt eesti keeles: saadad meile kirja, seda loevad ainult Maidu ja Mirette, me vastame ja hoiame sinu andmeid ainult nii kaua kui vaja. Sinu andmed lähevad tööandjale ainult konkreetse töökoha jaoks ja ainult sinu nõusolekul. Küpsiseid ega analüütikat sellel lehel ei ole. Küsimused ja soovid (andmete vaatamine, parandamine, kustutamine, nõusoleku tagasivõtmine): workingtheseasons@gmail.com. Kaebus: aki.ee.
Who is responsible
Maidu Rasva and Mirette Juurikas, Estonia, workingtheseasons@gmail.com. We run Working the Seasons together and decide together how your details are used; in data protection terms we are joint controllers. Write to either of us. Mirette usually answers candidates, Maidu employers. When our company is registered, its name, registry code and address will replace this paragraph.
What we receive
Only what you send us. The forms on this site send nothing to the website or to our hosting provider: the button opens your own email program with what you typed, you send it from there, and you can change or delete anything first. Your email then travels to us like any other email; until it reaches us, your own mail provider handles it under its rules.
From job seekers: your name, email, phone, the work you are looking for, when you can start, what you write about yourself, and a CV if you attach one. If we then talk, our notes from that conversation.
From employers: the company, your name, work email and phone, and what you write about the roles.
Please do not send us your personal identification code, copies of ID documents, bank details, or anything about your health, family plans, religion, union membership or politics. We do not need them, and if a CV contains them we do not use them. A photo on your CV is your choice; we do not ask for one.
This website
The site is served by Cloudflare, Inc. (USA), which also holds our domain. Like any web server, Cloudflare records each request: your IP address, the page, the time and your browser type. We do not read these logs. Cloudflare keeps them for a short time under its own rules, to deliver the site and keep it safe; that is our legitimate interest. Cloudflare may handle the logs in the United States; it is certified under the EU-US Data Privacy Framework and works for us under its data processing addendum. Everything the page loads (typefaces, pictures, video) comes from the site itself; no other company is contacted. The site sets no cookies and stores nothing on your device.
Why we use it, and on what legal basis
- To answer your message. Basis: our legitimate interest in replying to people who contact us (Article 6(1)(f) GDPR), or the next point where it applies.
- To find you work: to assess your experience, talk to you, and present you to an employer for a job you have agreed to. Basis: this is the placement service you asked us for (Article 6(1)(b), steps taken at your request before a contract).
- To keep you in mind for later openings, if you tick the box or tell us so. Basis: your consent (Article 6(1)(a)). You can withdraw it at any time.
- To work with employers: to answer enquiries, agree terms, present candidates and invoice. Basis: our legitimate interest in running a recruitment service and dealing with the businesses that contact us (Article 6(1)(f)), and the agreement with the employer where you are the contracting party (Article 6(1)(b)).
- To keep the site running and secure (the server logs above). Basis: our legitimate interest in a working, secure website (Article 6(1)(f)).
- To keep accounts. Once we invoice, Estonian accounting law obliges us to keep invoices and their supporting documents for seven years (Article 6(1)(c); Accounting Act, section 12).
- To deal with a complaint or a legal claim if one arises. Basis: legitimate interest (Article 6(1)(f)).
We never use your details for advertising and we never sell them.
If we contacted you first
Employers: we sometimes write to hotels and restaurants we have not spoken to before. We take the contact person's name and work email from the company's own website or from LinkedIn, and use them only to introduce our service. Basis: legitimate interest (Article 6(1)(f)). If you would rather not hear from us, reply and say so and we delete your details.
Referees: if a candidate names you as a reference, we hold your name, your contact details and what you tell us, only to check that candidate's experience. The candidate gave us your details.
Who else sees your details
- Google: our mailbox is a Gmail account, so Google stores our email under its own terms. We are moving to a business mailbox on our own domain, with a data processing agreement, before we take on candidates; this page will say so when it is done.
- Cloudflare: hosts this website and keeps the server logs described above.
- The employer: a candidate's details go to an employer only for a specific job, and only after the candidate has said yes to being presented for it. From then on the employer handles them under its own rules and its own privacy notice; Finnish law applies to a Finnish employer.
- Nobody else. No advertisers, no data brokers, no other agencies. We would hand details to an authority only if the law obliged us to.
Where your details are stored
Google and Cloudflare are American companies and may process data in the United States. Both are certified under the EU-US Data Privacy Framework, which the European Commission has recognised as giving adequate protection (Article 45 GDPR). The list of certified companies is at dataprivacyframework.gov.
How long we keep it
- A message that leads nowhere: deleted three months after our last exchange.
- A candidate we have presented to an employer: six months after that recruitment ends, so that we can answer questions about it. If you are hired, we also keep your name, the employer and the start date with our invoice for seven years, because accounting law requires it. Your CV is not kept for that.
- A candidate in our pool: twelve months from your consent. Before it runs out we ask whether you want to stay. If you do not answer, we delete your details.
- Employer contacts: while we work together and three years after the last contact, the limitation period for claims in Estonia. Invoices: seven years.
- Server logs: Cloudflare keeps them for a short time under its own rules.
When a period ends we delete the email and every copy of it. If you ask us to delete something earlier, we do, unless the law obliges us to keep it, as with invoices.
Your rights
You can ask us by email to:
- tell you what details we hold about you and give you a copy (access);
- correct anything that is wrong (rectification);
- delete your details (erasure);
- stop using them while a question is settled (restriction);
- give you the details you sent us in a common file format, or send them to someone else (portability).
We usually answer within one month. We may ask you to confirm who you are first.
Your right to object
Where we rely on our legitimate interest (see above), you can object at any time on grounds relating to your particular situation. We then stop, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for a legal claim. Email us to object.
Withdrawing consent
If you agreed to stay in our pool, you can withdraw that at any time with one line by email. We delete your details from the pool. Withdrawing does not affect what we did while your consent lasted.
Complaints
If you think we have handled your details wrongly, tell us first and we will try to put it right. You also have the right to complain to a supervisory authority: in Estonia the Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee, info@aki.ee); in Finland the Office of the Data Protection Ombudsman (tietosuoja.fi); or the authority where you live or work.
Do you have to give us anything?
No. Nothing is mandatory, and no law or contract obliges you. But without a way to reach you we cannot answer, and without your work history we cannot present you to an employer.
Automated decisions
None. Every message is read, and every decision about a candidate is made, by Maidu or Mirette personally. We do not profile you.
Changes
When something changes, for example when our company is registered, when our mailbox moves, or if we move to a form service, we update this page and the date at the top.