Skip to main content

Candidate Privacy Policy

Linuxhackingid ("we") is the data controller for all personal data you submit through this career portal. This policy explains what data we collect when you create an account and apply, on what basis we process it, who can see it, how long we keep it, and what rights you have - in line with Law No. 27 of 2022 on Personal Data Protection (UU PDP).

Last updated: 27 July 2026

1. Data We Collect

  • Account data - name, email address, WhatsApp number (optional), profile photo, and account role. If you sign in with Google, we receive your name, email, and profile photo from Google.
  • Candidate profile (digital CV) - headline, self-summary, city, education history, work history, skills, certifications, and LinkedIn, GitHub, personal website, and social media links you fill in yourself.
  • Application data - the position applied for, salary expectation, availability date, notice period length, how you heard about the opening, the referrer's name if you applied through a referral, and your answers to any additional questions set for that position.
  • Documents - your CV file, cover letter, and other attachments you upload, along with their original file names.
  • Communication - your conversations with the recruitment team inside the portal, interview scheduling invitations and notes, and notifications we send you.
  • Technical & security data - IP address, device and browser type, last sign-in time, the list of currently signed-in devices, and account activity records (password changes, revoked sessions, data downloads, deletion requests).

We do not ask for sensitive data such as health information, political views, or biometric data. Please do not include it in your CV or answers. If you send it anyway, we treat it the same as any other application content and do not use it as a basis for assessment.

2. Legal Basis for Processing

  • Your consent - given explicitly through the consent checkbox on the application form. You can withdraw this consent at any time (see section 9).
  • Fulfilling your request prior to an employment agreement - processing your application, scheduling interviews, and communicating selection outcomes are steps you requested yourself by applying.
  • Our legitimate interest - keeping accounts secure, preventing misuse of the portal, and maintaining an internal audit trail of selection decisions.
  • Legal obligation - when regulations require us to retain or hand over certain data.

3. How We Use Your Data

  • Assessing your fit for the position you applied to.
  • Contacting you about your application status, interview schedule, and job offers.
  • Compiling internal recruitment statistics - application counts per position, time spent in each stage, and candidate sources. These statistics are aggregate and are not used to assess you individually.
  • Keeping accounts secure and detecting suspicious activity.

We do not carry out fully automated decision-making: no algorithm rejects your application on its own. Scoring and evaluation are done by human reviewers, and final decisions are always made by the recruitment team.

4. Who Can See Your Application

Your application is not open to all staff. Access is limited to:

  • You, as the owner of the application.
  • Reviewers (recruiter/hiring manager) assigned to the opening you applied to. Simply holding a reviewer account is not enough - someone must be registered as a reviewer on that specific opening.
  • Recruitment portal administrators.

Your CV and attachments are never served as public files: they are stored outside any publicly served directory and can only be opened through a download route that checks your session and per-application access rights. Every selection-stage change and every file access is recorded in an internal audit log.

Internal evaluation records (reviewer scores and comments) are internal documents and are not shown to candidates.

5. Sharing Data with Third Parties

We do not sell your personal data and do not share it with other companies for their own recruitment purposes. Data is only processed by service providers that support this portal's operation - infrastructure/hosting providers and notification email delivery services - who are bound by confidentiality obligations, or when required by applicable law.

If you choose to sign in with Google, that authentication process is subject to Google's own privacy policy. We only receive basic profile data from that process.

6. How Long We Keep Data

  • Application data and CV files are kept until you ask for them to be deleted (see section 9) or our team deletes them; no fixed retention period is set at the moment. When one is set, it is at most 24 months.
  • Account data is kept for as long as your account remains active. A deactivated account can no longer be used to sign in.
  • Audit records and security logs are kept for a limited longer period, as evidence of selection decisions and administrative actions.

To be stated plainly: deletion after the retention period ends is carried out as a process our team follows up on, not an automatic system deletion. This portal records and queues deletion requests so they can be tracked, but the execution - including on backups and archives - is done manually.

7. Data Security

Controls we actually apply on this portal:

  • All traffic is served over HTTPS in the production environment.
  • Login sessions are stored in a signed cookie marked HttpOnly, so it cannot be read by scripts in the browser.
  • Role-based access restriction, plus per-application and per-file ownership checks - not just being "logged in".
  • CV files and attachments are stored outside the public directory and are only served through an authenticated route.
  • Dashboard pages are sent with headers that forbid storage in shared caches or the browser cache, so candidate data is not left behind on a shared device.
  • Passwords are never stored as plain text.
  • Rate limiting on password changes, data download requests, and account deletion requests.

What we do not claim: this portal does not apply separate encryption to files stored on the server, and no system is fully immune. We state this limitation openly so you can decide for yourself what documents are worth uploading.

8. Cookies

We only use functional cookies to keep you signed in. There are no advertising tracking cookies, no cross-site profiling, and no sale of behavioral data. Clearing cookies will sign you out of your session.

9. Your Rights as a Data Subject

  • Right to access and a copy of your data - You can download all the data this application holds about you (account, profile, applications, interviews, conversations, notifications, preferences, activity logs, and device list) from the Account Settings page in the dashboard. That download also lists what is not covered - for example server logs and email delivery records that live outside this application - along with how to request them.
  • Right to correction - your personal data and candidate profile can be updated by you at any time from the dashboard.
  • Right to withdraw an application - an application still in progress can be withdrawn from its detail page. An application that already has a final status can no longer be withdrawn.
  • Right to withdraw consent - withdrawing consent to data retention is equivalent to requesting deletion of your application data; submit it through the mechanism below or by email.
  • Right to deletion - requests to delete your account and personal data are submitted from the Account Settings page.

What happens when you request deletion, plainly: your request is recorded as a dated, identified audit entry so the recruitment team can act on it, your session in this app is ended and your account stays active until the request is processed. The data itself is not deleted at that instant: deletion across systems - including CV files, archives, and backups - is done manually and we follow up within 14 working days at the latest. You receive an email confirmation once the data has actually been deleted. Some data may still be kept if required by law or needed for a legal defense.

An account with the administrator role cannot delete itself through the portal; that role must be transferred first.

10. Minors

This portal is intended for job applicants and is not meant for minors. We do not knowingly collect data from children. If you become aware that this has happened, contact us so we can follow up.

11. Policy Changes

We may update this policy from time to time. A material change - including a change to the data retention period - will be marked by updating the date at the top of this page.

12. Contact Us

For data requests, consent withdrawal, objections, or privacy complaints, contact us and mention the email address you used when applying:

The portal's terms of use - including the statement that our recruitment process charges no fees at all - are explained separately in Terms & Conditions.