Privacy Policy
Last updated: 1 November 2026
This Privacy Policy explains how KoliJobs (“we”, “us”) collects and uses personal data when you use this website, and what rights you have under the EU General Data Protection Regulation (GDPR).
In short
- You can browse all jobs without an account. We collect personal data only if you sign up, save jobs or write to us.
- We never sell your data and use no advertising or analytics trackers.
- Only strictly necessary cookies are used, so there is no consent banner.
- You can download or delete your data at any time.
1. Data controller
| Controller | KoliJobs |
| Location | Tartu, Estonia (European Union) |
| visapath@zohomail.eu | |
| Other ways to reach us | The contact form on the Contact page |
2. What personal data we collect
| Category | What exactly | Where it comes from |
|---|---|---|
| Account | Email address; name and profile photo if you sign in with Google | You or Google |
| Profile | Desired role, preferred countries, alert settings | You |
| Saved jobs | Jobs you bookmark | You |
| Messages | Name, email, topic and text of your message | You |
| Technical | IP address, browser type, time of request (server logs) | Your device |
We do not ask for and do not want sensitive data (for example health data or passport numbers). Please do not include it in messages.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your account, save jobs, show your profile | Contract — Art. 6(1)(b) |
| Send weekly job alerts (only if you switch them on) | Consent — Art. 6(1)(a) |
| Reply to your messages and handle reports about listings | Legitimate interest — Art. 6(1)(f) |
| Keep the service secure and prevent abuse | Legitimate interest — Art. 6(1)(f) |
| Meet legal obligations (for example tax records for paid listings) | Legal obligation — Art. 6(1)(c) |
We do not make decisions about you based solely on automated processing, and we do not build advertising profiles.
4. Who we share data with
We share data only with service providers that help us run KoliJobs. They act on our instructions under data processing agreements and may not use your data for their own purposes.
| Provider | What for | Where / safeguard |
|---|---|---|
| Supabase | Database and sign-in | EU data centre |
| Vercel | Website hosting | EU and USA — EU Standard Contractual Clauses and EU–US Data Privacy Framework |
| “Continue with Google” sign-in (only if you choose it) | EU–US Data Privacy Framework | |
| Zoho | Our email inbox for replies to you | EU data centre |
| Stripe | Payments for paid listings (employers only) | EU (Stripe Payments Europe, Ireland) |
We may also disclose data if required by law or to protect our rights. We never sell personal data.
5. How long we keep data
| Data | Kept for |
|---|---|
| Account, profile, saved jobs | Until you delete your account |
| Messages to us | Up to 12 months after the conversation ends |
| Server logs | Up to 30 days |
| Inactive accounts | Deleted after 24 months without sign-in (we email you first) |
| Invoices for paid listings | 7 years (Estonian accounting law) |
6. Cookies and similar technologies
We use only what is strictly necessary for the site to work. Under EU rules these do not require consent.
| Name | Purpose | Duration |
|---|---|---|
| sb-…-auth-token | Keeps you signed in | Until you sign out |
| lang | Remembers your language | 12 months |
| theme (browser storage) | Remembers light or dark theme | Until you clear it |
| cookie-notice (browser storage) | Remembers that you closed the cookie notice | Until you clear it |
7. Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it;
- have incorrect data corrected;
- have your data deleted (you can delete your account yourself on the Profile page);
- restrict or object to processing based on legitimate interest;
- receive your data in a machine-readable format (data portability);
- withdraw consent at any time, for example by switching off job alerts.
To use your rights, email us or use the contact form with the topic “Privacy or data request”. We reply within one month.
You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee, info@aki.ee) or the supervisory authority in your country.
8. Emails we send
Sign-in links and important account notices are necessary to run your account. Job alerts are sent only if you switch them on, and every alert email contains an unsubscribe link. We do not send advertising from third parties.
9. Security
- All traffic is encrypted with HTTPS.
- Access to the database is limited by row-level security, so each user can only read their own data.
- If you choose a password, it is stored only as a salted cryptographic hash by our authentication provider (Supabase) — nobody, including us, can see it. You can also sign in with one-time email links.
- If a personal data breach puts your rights at risk, we will notify the supervisory authority within 72 hours and inform you without undue delay.
10. Job listings
Job information comes from companies’ public career pages and public job APIs. We store only the job title, company, location, date, a link to the original ad and a short quote. If you represent a company and want a listing corrected or removed, contact us and we will act promptly.
11. Children
KoliJobs is not intended for people under 16, and we do not knowingly collect their data.
12. Changes to this policy
If we change this policy, we will update the date at the top. For important changes we will also notify registered users by email.