Privacy Notice

​Privacy Policy – GDPR

Last Updated: 01/10/2026

Data Controller

Nordic Jobs Worldwide AS, trading as Worldwiders Recruitment, is the data controller for the personal data described in this Privacy Policy. This includes personal data processed under our recruitment brands Nordic Jobs Worldwide, Multilingual Jobs Worldwide and Worldwiders Executive Search and by our group companies Nordic Elite Group Spain S.L., Nordic Jobs Worldwide Portugal Unipessoal LDA and Nordic Jobs Worldwide Estonia OÜ.

For questions regarding privacy or to exercise your data protection rights, please

contact: privacy@worldwiders.com

Registered address: Stortorvet 7, 0155 Oslo

Organisation number: 913 237 765

Our Data Protection Officer can be contacted at the same address: privacy@worldwiders.com.

​

This Privacy Policy (also referred to as our Privacy Notice) explains how Worldwiders collects, uses, stores, shares and protects personal information in connection with our recruitment services, and describes the rights available to individuals whose personal data we process.

Lawful Basis for Processing

We process personal data in accordance with applicable data protection legislation, including the General Data Protection Regulation (GDPR). Depending on how you interact with us and the purpose of the processing, we may rely on one or more of the following lawful bases:

• Legitimate Interests – where processing is necessary for our legitimate business interest in providing recruitment and employment-related services, provided that these interests are not overridden by your rights and freedoms.

• Consent – where we specifically request your consent for a particular processing activity.

• Pre-contractual or contractual measures – where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract with you. A contract between us and a client does not, by itself, provide this lawful basis for processing your personal data.

• Legal Obligations – where we are required to process or retain information in order to comply with applicable laws or regulatory requirements. Our legitimate interests are assessing candidates for vacancies, matching candidates with suitable roles for our clients, maintaining relevant candidate relationships, and keeping necessary recruitment and placement records. We assess these interests against your rights and reasonable expectations. You can request further information about this assessment by contacting privacy@worldwiders.com.

The lawful basis we rely on depends on the activity:

• Reviewing your application, making an initial approach to a sourced or referred candidate, and managing a recruitment process you choose to participate in – our legitimate interests in providing recruitment services. We rely on pre-contractual or contractual measures only where the processing is necessary for a contract with you, as explained above.

• Keeping directly submitted profiles for future opportunities and informing those candidates about relevant vacancies – legitimate interests, subject to your right to object and the 3-year review described under Data Retention Policy. For sourced or referred candidates, the separate consent rule below applies to keeping a profile for future opportunities.

• Keeping a full profile of a sourced, headhunted or referred candidate for future opportunities – your freely given, specific and informed consent, requested by email. You may decline or withdraw this consent without preventing us from handling a specific application you choose to pursue on

the lawful basis described above. Silence is not consent.

• Presenting your CV or other identifiable information to a client for a specific role – our legitimate interests in managing the recruitment process you have chosen to pursue, and only after receiving your agreement to that particular submission. This agreement is separate from consent to retain a profile for future opportunities.

• Keeping limited records after a placement – legal obligations (for example accounting rules) and legitimate interests.

Providing your CV or other information is not, by itself, consent to every use of your data. We use the lawful basis specified above for each purpose, collect only the information needed, and explain any new purpose and applicable lawful basis before using your data for it. We provide this Privacy Policy when we collect personal data directly from you. Where we obtain data from another source, the notification timing described below applies. The policy is also available through our website and recruitment channels.

You are not legally or contractually required to give us your personal data, but we cannot consider you for roles without basic information such as your CV and contact details.

Personal Data We Process

Depending on how you interact with us, we may process the following personal data:

• Identity and contact details, such as your name, email address, phone number, location and links to your professional profiles.

• Your CV and professional information, such as work history, education, qualifications, skills, certifications and language abilities.

• Recruitment information, such as the roles you have applied for or discussed with us, interview and assessment notes, your job preferences, availability, notice period and salary expectations.

• Work authorisation information, where it is relevant to a role.

• Records of our communication with you, including copies of the privacy emails we send you and your responses to them.

• The source of your information, such as a job board, a referral or your own application.

How We Acquire / Collect Your Personal Data We obtain candidate information through several channels:

Direct applications and interaction

You may provide your information directly to us by applying for a vacancy, submitting your CV through our website or a job advertisement, contacting one of our recruiters or company email addresses, responding to a recruitment campaign, or otherwise communicating with us regarding employment opportunities.

Where you voluntarily provide information for recruitment purposes, we may process and store that information in accordance with this Privacy Policy.

Recruitment platforms and CV databases

We may receive candidate information through recruitment platforms, professional networks, job boards and CV databases where candidates have made their professional information available for recruitment purposes. Where we obtain your information from another source, we tell you the source,

including whether it was publicly accessible, and provide the information required by GDPR within a reasonable period and at the latest within one month. If earlier, we do so at our first communication with you or before first disclosing your data to another recipient. We rely on an exemption only where it applies under GDPR.

Headhunting and Direct Sourcing

Our recruiters may identify potential candidates through professional platforms such as LinkedIn or other recruitment and networking channels.

Where an individual has not directly applied or otherwise engaged with Worldwiders, we initially process only the limited professional information reasonably necessary to decide whether there may be a relevant employment

opportunity and to make an initial approach. Until the candidate confirms that they want to engage with us, we do not download or store their full CV. We also avoid using contact details linked to a candidate's current employer for recruitment approaches unless the candidate has specifically provided or authorised them. When a sourced or referred candidate is added to our recruitment system, we send an email straight away, normally within an hour, with a link to this Privacy Policy and a request for consent to keep a profile for future opportunities. We send up to two reminders. If consent is not received within 16 days of the profile being created, we delete the profile, except for information necessary for a specific recruitment process the candidate has chosen to pursue or for a separately justified retention purpose described below. An active process does not authorise

retention for future opportunities without consent. A technical link to an earlier process does not, by itself, justify continued retention. Where deletion requires technical work, access and use are restricted while that work is completed without undue delay. Candidates may decline further contact or request deletion at any time.

Referrals

Candidates may also be introduced to us through employee, candidate or business referrals. Where this occurs, we will initially process only the minimum information necessary to contact the referred individual.

The referred individual will be informed that their information has been shared with us, provided with access to this Privacy Policy, and given the opportunity to decide whether they wish to engage with Worldwiders. If the referred individual does not confirm that they want to engage with us, their information is deleted as described under Headhunting and Direct Sourcing.

ATS/CRM / Candidate Privacy Notification

Candidate information used for recruitment purposes may be stored within our recruitment CRM/ATS system. Where a candidate enters our recruitment system and has not already received or had clear access to our Privacy Policy through the original application channel, we will provide the Privacy Policy directly to the candidate in accordance with applicable data protection requirements.

We send privacy notifications by email and save a copy in the candidate profile. If an email fails or bounces, we may try another appropriate channel, such as a phone call or message, where we have your contact details. A record of sending an email does not establish that it was delivered or read. Candidates who apply to us directly receive an email confirming that we hold their profile, with a link to this Privacy Policy and an easy way to ask us to erase their data.

How We Process Your Information

Depending on the lawful basis applicable to your interaction with us, we may process your information for purposes including:

• Contacting you regarding relevant employment opportunities through email, telephone, SMS, WhatsApp, social media or other appropriate recruitment channels.

• Evaluating your qualifications, experience, language skills, work authorization and suitability for employment opportunities.

• Conducting recruitment interviews and maintaining interview or assessment notes.

• Managing your applications and recruitment processes.

• Communicating with you regarding interviews, offers, onboarding and recruitment updates.

• Maintaining an appropriate recruitment history and candidate relationship within our recruitment system.

• Informing you about other relevant vacancies where we reasonably believe these may be of professional interest to you.

We only present your CV or other identifiable information to a specific client after discussing the relevant opportunity with you and receiving your agreement to be presented for that position. Agreement may be given verbally, by email or by written message, and we record it. Prospective employers generally act as separate controllers for their own recruitment decisions; their privacy notices explain how they use your information.

We may share your personal information with third parties where reasonably necessary to provide our recruitment services or meet our legal and contractual obligations. These may include:

• Prospective employers and clients, where you have agreed to be presented for a specific opportunity;

• Recruitment technology, CRM/ATS and applicant management providers;

• Communication, email delivery, scheduling and collaboration service providers;

• Cloud hosting, data storage, workflow automation and IT service providers;

• Assessment, testing or background-check providers where relevant and permitted by law;

• Professional advisers, such as legal or accounting providers; and

• Government authorities, regulators or other parties where disclosure is required by law.

Where third-party service providers process personal data on our behalf, we require appropriate contractual and data protection safeguards. We only share personal information that is reasonably necessary for the relevant purpose. For newsletters or other direct marketing, we obtain prior consent where required by applicable electronic marketing rules and provide an easy way to unsubscribe. You may object to direct marketing at any time, and we will stop processing your data for that purpose. Recruitment messages are also subject to applicable communication and marketing rules.

Automated Processing and AI Tools

We do not make decisions about candidates based solely on automated processing, including profiling, that have legal or similarly significant effects on them. We may use software, including AI tools, to help organise and tag candidate information. Any such tagging is reviewed by a member of our team and is never used on its own to make a decision about a candidate. Some administrative steps are automated, such as sending privacy emails and reminders, and removing the profiles of sourced or referred candidates who have not confirmed that they want us to keep them.

International Data Transfers

As an international recruitment company working with candidates and clients in more than 40 countries, both inside and outside the EU/EEA, we may process or make personal information accessible in the locations where Worldwiders operates. This may include access by authorised personnel, group companies, clients or service providers located outside the European Economic Area (EEA). Where personal data is disclosed or made accessible to a separate Worldwiders group company, affiliate, contractor, client or service provider located outside the EEA and the activity constitutes an international transfer under applicable data protection law, we will ensure that an appropriate transfer mechanism and safeguards are in place. These may include an adequacy decision, the European Commission’s Standard Contractual Clauses, or another legally recognised transfer mechanism, together with supplementary measures where appropriate.Where authorised employees of Nordic Jobs Worldwide AS access personal data while located outside the EEA, such access will remain subject to our internal data-protection, confidentiality and information-security requirements, including

appropriate access controls and technical safeguards. Where required, we assess the legal and practical risks associated with transfers to third countries and document appropriate safeguards before access is permitted.

Where your personal information may be shared with a prospective employer outside the EEA, we will provide appropriate information in connection with the relevant recruitment process where required.

You can ask us for more information about the safeguards we use for international transfers, including a copy of the relevant Standard Contractual Clauses, by contacting privacy@worldwiders.com.

Special Categories of Personal Data

We do not normally require candidates to provide special-category personal data, such as information concerning health, racial or ethnic origin, religious beliefs, trade union membership or sexual orientation. Where such information is processed, we will only do so where necessary and where an applicable condition under Article 9 GDPR and applicable national law permits the processing.

Criminal Conviction and Offence Data

We do not routinely collect or process information relating to criminal convictions or offences. Where a particular role requires a criminal record or background check, such information will only be requested and processed where permitted by applicable law and in accordance with Article 10 GDPR and appropriate safeguards. We will only retain such information for as long as reasonably necessary for the relevant recruitment or legal purpose.

Data Retention Policy

Lawful Business Interests and Candidate Data Retention

We retain personal data only for as long as it remains reasonably necessary for the recruitment purposes for which it was collected, for maintaining an active candidate relationship, or where retention is necessary to meet legitimate business, contractual or legal obligations.

Candidate Profiles and 3-Year Retention Review

For directly submitted profiles retained on legitimate interests, the standard review point is 3 years from creation in our recruitment system. For sourced or referred profiles retained for future opportunities on consent, it is 3 years from the initial consent. The shorter 16-day rule applies while we await that consent. Information needed for a specific active recruitment process or for limited placement records is assessed separately. In all cases, we delete or anonymise data earlier when the purpose ends or a valid withdrawal or objection requires it.

When reviewing whether a profile remains relevant and accurate, we may

consider candidate interactions such as:

• applying for a vacancy;

• replying to recruitment communication;

• participating in a recruitment conversation or interview;

• providing an updated CV or professional information;

• asking to be considered for future opportunities;

• participating in an active recruitment process.

A later application or other candidate interaction may inform our assessment of relevance and accuracy but does not automatically restart the 3-year period. We keep only information needed for a continuing recruitment purpose. We periodically review whether continued storage remainsnecessary and proportionate. The 3-year period is a review point, not permission to retain every profile automatically or indefinitely.

Profiles created under an earlier version of this Privacy Policy keep their existing review date, without extending any shorter retention commitment previously given.

Publishing this policy does not reset retention periods, create consent or automatically change the lawful basis for existing processing.

Review at 3 Years

30 days before the 3-year review point, we intend to send a retention and privacy review notice. For profiles held on legitimate interests, this explains the proposed retention and how to object or request deletion; silence is not consent or sufficient

justification for retention. For profiles held on consent, we request fresh consent for a further period of up to 3 years. If it is not received by the existing review deadline, we delete or anonymise the profile held for future opportunities, subject

only to separately justified limited records described below. For profiles held on legitimate interests, further retention for up to 3 years requires a documented assessment of a continuing recruitment purpose, necessity, proportionality, accuracy and your rights and expectations. We set an earlier review or deletion date where appropriate. This assessment does not replace fresh consent for profiles held on consent. We do not switch the same consent-based processing to legitimate interests simply because consent is withdrawn or not renewed. Invalid or bounced email addresses may trigger a data-quality and retention review; a failed notice does not extend retention.

Right to Erasure / Right to be Forgotten

You may request deletion of your personal data or object to processing based on legitimate interests at any time by contacting us at privacy@worldwiders.com or by using the erasure link in our emails.

Where applicable under GDPR, we will delete or anonymise your personal information.

The right to erasure is subject to the conditions and exceptions in Article 17 GDPR. We may retain limited information where an applicable exception permits it, for example to comply with a legal obligation or to establish, exercise or defend legal

claims. General record-keeping preferences or a client contract do not, by themselves, override a valid erasure request.

If we cannot fully comply with an erasure request, we explain the information retained, the reason and legal basis, and the applicable retention period or criteria. We also explain your right to complain and seek a judicial remedy. Where required by GDPR, we notify recipients of rectification, erasure or restriction, unless this is impossible or involves disproportionate effort; you may ask which recipients were notified.When we have deleted or anonymised your data, we will confirm this to you.

Placed Candidates – Right to be Forgotten

For candidates successfully placed with one of our clients, we will anonymise or remove personal information that is no longer required once the relevant recruitment and retention purposes have ended.

We may retain limited information where reasonably necessary for:

• placement and contractual records;

• commission or fee tracking;

• records necessary to resolve a specific placement or fee dispute;

• legal or regulatory obligations;

• establishing, exercising or defending legal claims;

• preventing duplicate or inaccurate placement records.

Records retained for these limited purposes are restricted to what is necessary and are not retained as an active candidate profile for future recruitment. Continued use for future opportunities must meet the separate lawful-basis and retention rules above.

Limited placement records are subject to a 3-year retention review from the placement date. At that review, we delete or anonymise records unless a documented assessment justifies retaining specific information for a further

defined period of up to 3 years, or a legal obligation requires a different period. The assessment considers unresolved placement fees, an actual or reasonably anticipated legal claim, applicable limitation periods and your rights and expectations. We retain only the information necessary for that purpose and set an earlier deletion date where appropriate. Mandatory accounting or regulatory retention periods apply to the relevant records, rather than to the whole candidate profile. A placement or retention review does not automatically restart the retention period for a profile held for future opportunities.

Right to Rectification

You have the right to request correction of inaccurate or incomplete personal information held about you.Candidates are also encouraged to provide updated information or CVs whenever their professional circumstances change.

Where a candidate provides new information, applies for another vacancy, responds to recruitment communication or otherwise re-engages with Worldwiders, the relevant candidate profile may be updated and its relevance and accuracy reassessed. Such activity does not automatically restart the retention period.

Requests for rectification can be submitted to privacy@worldwiders.com

Other Data Protection Rights

In addition to the rights described above, you may also have the following rights under applicable data protection law:

• Right of Access – You may request a copy of the personal data we hold about you and information about how it is processed.

• Right to Restriction – In certain circumstances, you may request that we restrict how we process your personal data.

• Right to Object – You may object to processing based on legitimate interests on grounds relating to your particular situation. We will stop unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or need the data for legal claims. For direct

marketing, your objection is absolute: we stop using your data for that purpose, including related profiling. You may also ask us not to contact you about future opportunities.

• Right to Data Portability – Where processing is automated and based on consent or a contract with you, you may receive personal data you provided in a structured, commonly used and machine-readable format and ask us to transmit it to another controller where technically feasible, subject to the rights of others.

• Right to Withdraw Consent – You may withdraw consent at any time by contacting privacy@worldwiders.com or using the relevant option in our privacy emails. Withdrawal must be as easy as giving consent and does not affect processing lawfully carried out before withdrawal. We stop the consent-based activity and delete or anonymise the data unless a separate, previously identified purpose and lawful basis justify limited retention.

• Right to Lodge a Complaint – You may complain to the Norwegian Data Protection Authority (Datatilsynet), at www.datatilsynet.no, or to a competent supervisory authority, in particular in the EEA country where youhabitually live or work or where the alleged infringement occurred. You do not have to contact us first. To exercise any of these rights, please contact us at privacy@worldwiders.com We respond without undue delay and within one month of receiving your request. Where necessary because of the complexity or number of requests, we may

extend this by up to two further months; we notify you of the extension and reasons within the first month. If we have reasonable doubts about your identity, we request only the additional information necessary to verify it. Requests are normally free of charge. Any permitted fee or refusal for a manifestly unfounded or excessive request will be explained, together with your complaint and judicial remedy rights.

Updates to this Privacy Policy

We may update this Privacy Policy periodically to reflect changes in legislation, our recruitment processes, technology or how we process personal information. The latest version will always display the relevant Last Updated date.

Where we make material changes to how candidate personal information is collected, processed, shared or retained, we will take reasonable steps to bring those changes to the attention of affected individuals. This may include publishing a prominent notice and/or sending an “Update to our Privacy Policy”communication to candidates already registered in our recruitment database.

Updating our Privacy Policy does not necessarily mean that we will request new consent from every candidate. Where our processing continues to rely on another applicable lawful basis, such as legitimate interests, the communication may be provided for transparency purposes.