Candidate privacy notice

Last updated 2 October 2026

Bletchley Int. OÜ ("Bletchley", "we", "us") is the controller of the personal data you share when you apply for a role. This notice replaces the July 2026 version.

1. Introduction

Trust is the foundation of everything we do. This notice explains how we collect, use, store, share and protect your personal data when you apply for a role with Bletchley Int. or express interest in working with us. It applies to all applicants, wherever they are, and follows the EU General Data Protection Regulation (GDPR) and other applicable data protection laws. By submitting your application you confirm that you have read it.

2. Who we are

Bletchley Int. OÜ develops trusted business intelligence and due diligence solutions. For the purposes of data protection law we are the controller of your data during recruitment. Our company details are in the Legal notice. Privacy contact: privacy.bi@bletchleyint.com.

3. When this notice applies

you apply for a published vacancy;
you send an unsolicited application;
you communicate with us about employment opportunities;
you take part in interviews or recruitment assessments.

4. Personal data we collect

Our application form asks for your name, email address, location, a LinkedIn profile link (optional), your CV and answers to questions about the role. Depending on the role and the stage of recruitment we may also process:

Professional information: employment history, education, qualifications, certifications, languages, skills and any portfolio or website you provide.
Recruitment information: interview notes, assessment results, evaluations by our team, availability, and our communications with you.
References: contact details and feedback of referees you nominate, with any permission the law requires.
Identity and right-to-work information, only where the law requires it and at a later stage.

5. How we collect your data

We collect data directly from you when you apply, upload documents, correspond with us or attend interviews. We may also receive information from recruitment agencies acting for you, from professional networks where you have made information public or shared it with us, and from referees you name.

6. Why we use your data

assessing your suitability and evaluating qualifications and experience;
communicating with you and arranging interviews and assessments;
verifying information you give us and carrying out reference checks where appropriate;
keeping records of our recruitment activity and complying with legal obligations;
considering you for future vacancies, where you have agreed or the law allows.

We collect only what is reasonably necessary for these purposes.

7. Legal basis

taking steps at your request before entering into an employment or service contract;
our legitimate interest in identifying suitable candidates and managing recruitment efficiently;
compliance with legal obligations;
your consent, where the law requires it. You can withdraw consent at any time, without affecting processing already carried out.

8. Recruitment decisions

People review every application, and hiring decisions are made after human review. We do not make hiring decisions solely by automated processing.

9. Who we share your data with

We share your data only where necessary and only with people and organizations involved in recruitment:

our team members and hiring managers who take part in the process;
service providers that run our recruitment systems: Vercel (hosting), Supabase (database and private CV storage), Resend (email delivery) and Microsoft (email and calendar);
legal, regulatory or governmental authorities where disclosure is required by law.

These providers process data on our instructions under data processing terms. We do not sell your personal data.

10. Transfers outside the EEA

Our website functions run in the European Union. Where a provider processes data outside the EEA we rely on a European Commission adequacy decision (including the EU-US Data Privacy Framework for certified providers) or on Standard Contractual Clauses.

11. How long we keep your data

If you are not selected, we keep your application for up to 24 months after the recruitment process ends.
If you withdraw your application, we may keep your data for up to 12 months.
If you join us, your recruitment records become part of your employment records, managed under our employee privacy information.

At the end of the period your data is deleted or anonymised, unless the law requires us to keep it or we need it to establish, exercise or defend a legal claim.

12. Security

We protect your data with technical and organizational measures that include individual accounts with hashed passwords for our team, access limited to people involved in hiring, encrypted connections, private storage for CVs, and limits on repeated sign-in attempts. More detail is on our Security page. No method of electronic transmission or storage can be guaranteed to be completely secure.

13. Your rights

Subject to applicable law you can ask to access, correct or delete your personal data, restrict or object to its processing, withdraw consent, or receive your data in a portable format. Write to privacy.bi@bletchleyint.com. We may ask you to verify your identity first. You may complain to the Estonian Data Protection Inspectorate (aki.ee) or to the authority in your country of residence or work.

14. Cookies and local storage

The careers pages do not use cookies. Your browser keeps a short list of open roles so the pages load quickly, and nothing about your application is stored in your browser. See the "Cookies and local storage" section of our Privacy policy.

15. Changes to this notice

We may update this notice. The latest version is always on this page, with the date shown above.

16. Contact

Questions about this notice or about how we handle your data: privacy.bi@bletchleyint.com.