Privacy notice

Who we are

OÜ WorkingtheSeasons is the controller of your personal data. For privacy questions or requests, email info@workingtheseasons.com. Our registration details are below.

Information we collect

• Candidates: contact details, CV, experience, skills, languages, availability and recruitment notes.
• Employers: company and business contact details, staffing requirements and correspondence.
• Other enquiries: your contact details and message.
• Referees: contact details provided by a candidate and information about that candidate's experience.
• From employers: whether a candidate we presented was hired, the role and the start date, so we can invoice our fee.
• Guide buyers: name, email and, for a printed copy, phone number and the parcel locker you choose. If you withdraw, your name, email, order details and any message. Card details go to Stripe, never to us.

Providing information is voluntary. Our application form requires your name and email; other forms need an email address or phone number so we can reply. Other fields and CVs are optional, but we need relevant work information to assess an application. Please do not send ID documents, bank details or sensitive personal information.

Why we use it

• Enquiries, applications and reference checks: our legitimate interests in responding, matching candidates to suitable roles and checking experience (GDPR Article 6(1)(f)).
• Future vacancies: your consent to keeping your details in our candidate pool (Article 6(1)(a)).
• Employer relationships: our legitimate interest in arranging recruitment and managing business relationships (Article 6(1)(f)), or fulfilling our contract where you are personally a contracting party (Article 6(1)(b)).
• Website operation and security: our legitimate interest in providing a working, secure website (Article 6(1)(f)).
• Accounting: our legal obligations under Estonian accounting law (Article 6(1)(c)).
• Introduction and placement records: our legitimate interest in proving our introductions and invoicing employers, and Estonian law requiring brokers to keep such records (Article 6(1)(f) and (c)).
• Selling the guide: performing the sales contract (Article 6(1)(b)) and keeping accounting records (Article 6(1)(c)).
• Complaints and legal claims: our legitimate interest in resolving or defending them (Article 6(1)(f)).

Employer outreach

We may obtain employer contacts from company websites or LinkedIn and use them for relevant business outreach based on legitimate interest (Article 6(1)(f)). We use personal work addresses only where the service relates to the recipient's responsibilities and applicable marketing rules allow it; otherwise we seek consent first. Each message identifies us and provides a free way to opt out. We stop marketing when you object and keep only the minimum record needed to respect that choice.

Storage and sharing

We use Google for company email and document storage, and Cloudflare for website hosting and form delivery. Stripe handles payments for the guide, and Omniva receives your name, phone number and parcel locker to deliver a printed copy. Within our company, access to recruitment records is limited to authorised personnel.

We share candidate details with an employer only after you agree to being presented for a specific job. Before that, we tell you who the employer is and what we will share. The employer then processes them as a separate data controller and tells us whether you were hired and when you started work, so we can invoice our fee. We also disclose information to authorities when required by law.

Google, Cloudflare and Stripe may process data in the United States. For transfers covered by their EU-US Data Privacy Framework certifications, we rely on the EU adequacy decision. Their data-processing agreements provide further details and safeguards: Google, Cloudflare and Stripe.

Website information

Cloudflare processes technical connection and usage data, including IP addresses, to deliver and protect the website and forms. Technical and delivery records are retained under its service-specific rules and privacy policy.

We use no website analytics or advertising trackers. Our website features do not set cookies. When you open a guide you bought, our server checks the purchase with Stripe using the code in the page address; nothing about it is stored. Links to external services take you to their own privacy policies.

How long we keep information

• Enquiries that go no further: three months after our last exchange.
• Applications not presented to an employer: six months after our last exchange.
• Candidates presented to an employer: six months after that recruitment ends. After that, we keep only a short record (name, employer, role, introduction date and any start date) until the end of the third calendar year after the year our fee for that introduction fell due (or, if no hire is known, the year the twelve-month start window ended), and longer only while a fee claim is open, because Estonian law requires brokers to keep such records for at least three years and we may need them to prove our fee.
• Future vacancies, with your consent: twelve months from consent. We ask before renewing; without renewal, we delete your details.
• Employer contacts: throughout the relationship and three years after the last contact.
• Guide orders: seven years from the end of the financial year, as accounting records required by Estonian law.
• Invoices and necessary supporting records, including essential placement details: seven years from the end of the relevant financial year, as required by Estonian law. This does not include CVs.

The candidate-pool period applies if you opt in. Otherwise, the enquiry, application or recruitment period applies. These periods cover emails, files and directory entries; referee information follows the candidate's period. We may retain necessary records longer for a legal obligation or claim. Google may retain recoverable copies or backups temporarily under its deletion rules.

Your rights

Email info@workingtheseasons.com to request access, correction, deletion, restriction or, where applicable, transfer of your data. These rights are subject to GDPR conditions; portability applies to data you provided that we process automatically based on consent or a contract. We respond within one month; complex or numerous requests may take up to two additional months, with an explanation within the first month.

You can withdraw consent at any time, without affecting earlier lawful processing.

Your right to object

You can object to processing based on legitimate interest for reasons relating to your situation. We stop unless overriding legitimate grounds or a legal claim justify continuing. For direct marketing, you can object without giving a reason and we stop.

You may complain to Estonia's Data Protection Inspectorate, Finland's Data Protection Ombudsman, or the authority where you live or work.

Application decisions

Our recruitment team reviews applications. We do not make decisions about candidates solely by automated processing. The employer makes the final hiring decision.

Company details

OÜ WorkingtheSeasons
Registered in the Estonian Commercial Register, registry code 17617928.
Registered address: Juhkensoni, Lalli küla, Kehtna vald, Rapla maakond, 79017, Estonia.
info@workingtheseasons.com