Privacy Notes

For recruitment, internship and volunteering activities

Last updated: 07.10.2026

This notice explains how we collect, use, store and protect your personal data when you use the Estonian Refugee Council (ERC) recruitment platform. This includes when you create an account, complete your profile, or apply for a job, internship, volunteering opportunity or expert roster.

NGO Estonian Refugee Council, legally registered as MTÜ Eesti Pagulasabi, registry code 80137003, is registered in the Republic of Estonia and operates branch offices in Ukraine, Armenia, Georgia, Syria and Palestine. MTÜ Eesti Pagulasabi is responsible for the processing of your personal data through the recruitment platform

1. What information we collect?

1.1. When you create an account

• Your email address and a password.
• Your agreement to the processing of your personal data for recruitment, internship, volunteering and expert roster purposes. This agreement is required to create an account. We also record the date on which the agreement was provided.

1.2. When you build your profile

You can decide what information you would like to include in your profile, although certain details may be required when applying for a specific vacancy.

This may include:

• Your full name, email address and phone number.
• Your country.
• Your skills and languages, including how well you speak each language.
• Your education history - the qualifications you list, one entry at a time.
• Your employment history - the jobs you list, one entry at a time.
• Your CV and any supporting documents you upload.

1.3. When you apply for a vacancy

When you apply for a vacancy, the information you provide as part of your application may include:

• Your answers to the application form, including any screening questions set by the recruitment team
• Documents requested as part of the application, such as a CV, motivation letter, diploma or certificate, reference, identity document, signed safeguarding declaration, volunteer agreement or learning agreement.
• Where relevant, your availability and, for internships, information about your studies (for internship)
• The language selected on the recruitment platform when you submit your application, so that we can communicate with you in the same language.

1.4. Information created about you as your application progresses

As your application progresses, additional information may be created and recorded as part of the recruitment process. This may include:

• The status and history of your application, including relevant updates and when they were made.
• Notes, comments, recommendations and assessments made by members of the recruitment team and interview panel during the recruitment process.
• Where an interview takes place, the interview date and the names of the interview panel members.
• Messages sent to you through the recruitment platform and records of when they were sent.
• Where required for a specific position, information obtained through reference or background checks.
• Records of certain actions involving your personal data, such as when your data is exported and by whom, to help ensure that the recruitment platform is used appropriately and securely.

1.5. Technical information

• When you submit an application form, the underlying form system records the submission and technical details about it, including the IP address the form was submitted from. This is deleted when your record is anonymised or deleted (see below).

The platform runs on Drupal 10 and is hosted by Zone.ee. Cookies or similar technologies may be used to maintain your login session and support the platform’s operation and security. Your browser settings may affect how these technologies work.

Any additional use of analytics or other optional tracking will be explained in the relevant privacy or cookie information, and your consent will be requested where required.

2. Why we collect it?

We collect this information so that we can:

• let you create and keep one profile instead of re-entering the same details for every application;
• receive, read and assess your application;
• check whether you meet the basic requirements for an opportunity;
• arrange and record interviews and assessments;
• decide who to offer a role, an internship, a volunteering placement or a roster position to;
• write to you about your application;
• keep an accurate, checkable record of how each recruitment was decided, which we need in order to be accountable as an organisation;
• produce internal reports about our recruitment - for example how many people applied, and how long recruitment takes. These reports count applications; they are not used to make decisions about you individually.

We use your personal data only for the purposes described above and only share it with people who are involved in the recruitment process.We process your personal data based on our legitimate interest in ensuring a fair and effective recruitment process and in accordance with the data protection laws applicable in the country where the recruitment takes place.

3. How we use your information?

Your profile and application are reviewed by the ERC team members involved in the recruitment process. As part of the process, they:

• read your profile, your CV and your answers;
• compare candidates against what the role needs;
• record their views and recommendations;
• move your application through the stages of the process;
• write to you about the outcome.

If a screening question identifies that a requirement is not met, this information is shown to you before you submit your application. Other screening responses may be flagged for further review.

If you are offered and accept a role, some of your details may need to be passed to ERC's wider HR systems so that you can be onboarded as an employee. If you are offered and accept a role, ERC may transfer relevant information from your application, including your name and CV, to its internal HR systems to arrange your employment. ERC will also request additional information needed for employment administration, such as your home address and bank details. The use of that information will be explained in a separate employee privacy notice when it is collected.

Candidates who reach the final stage of recruitment may be asked to undergo background and reference checks. For a reference check, the candidate selects two former employers or other professional referees and obtains their permission before sharing their contact details with ERC. ERC will then contact the referees and ask them to complete its reference-check form.

When ERC contacts a referee, ERC will disclose the candidate’s name, the position for which they have applied, and the fact that they have reached the final stage of ERC’s recruitment process.

Depending on the position and applicable requirements, a successful candidate may also be required to complete a sexual exploitation and abuse self-declaration, undergo a criminal-record check, submit a conflict-of-interest declaration, or provide other information required under applicable law or ERC’s internal policies. ERC will request and process only the information necessary for the relevant role and checks.

Institutional donors may request evidence that ERC has completed the required checks and collected the necessary forms. These records are normally retained within ERC’s systems rather than sent to donors. Where necessary, authorised donor representatives may be shown relevant evidence during an online call or an in-person review. ERC will limit what is shown to what is necessary for that verification.

4. How CVs and supporting documents are used?

• Your CV and supporting documents are stored privately and are not publicly accessible. Access is restricted to authorised people who need them for recruitment or related administration (HR staff, hiring managers, panel members).
• A document can only be opened by someone who is allowed to see a record that document is attached to. Your CV and supporting documents can only be accessed by authorised ERC staff involved in the recruitment process, including HR and, where necessary, members of the relevant selection panel.
• Documents can be previewed in the browser by aforementioned reviewers so they do not have to download copies.
• If you replace a document with a newer version, we keep the older version as well, so that there is a record of what was actually submitted at the time. Both versions are deleted together if your information is later deleted.
• Background checks and similar sensitive documents are restricted further: only people with specific permission can open them, and each time one is opened it is recorded.
• Accepted file types are PDF, Word, OpenDocument, RTF, plain text, and JPG/PNG images. The current limit is 10 MB per file.

5. How application and screening information is used?

• Your answers are stored with your application and shown to the people assessing it (HR manager, hiring manager, panel members).
• Screening answers automatically produce a simple result for each question - met, flagged for a human to look at, or not met - and a summary so that the recruitment team can see at a glance where an application needs attention.
• If your screening answers indicate that you do not meet a requirement, the form informs you before you submit your application. This does not automatically result in rejection; recruitment decisions are made by a person.
• Screening results, notes and assessments are internal. They form part of the recruitment record.

6. Who may access your information?

Access is limited by role, and further limited by which recruitments a person is actually involved in. In broad terms:

Some further rules that apply to everyone:

• ERC staff can only access candidate information related to the recruitment processes they are involved in.
• Background checks and similar sensitive documents need a separate, specific permission.
• Sensitive actions - changes of status, documents uploaded, messages sent, exports of someone's data, changes to people's permissions - are recorded in an audit log, together with who did it and when. That log is not editable by ordinary users.

7. How long we keep your information?

Your account and your profile stay for as long as you keep the account. You can delete it yourself at any time (see below).

For applications, the platform has a retention system that can automatically anonymise or delete an application once enough time has passed since the recruitment concluded. The period can be set separately for each pathway (jobs, internships, volunteering, roster), and separately for successful and unsuccessful applications.

7.1. Retention periods and configuration:

• We retain application information for 2 years after the recruitment process has concluded. Where the candidate joins ERC following the recruitment process, relevant recruitment information is retained for 7 years. After the applicable retention period has ended, the personal data is anonymised.

The platform keeps a record of messages sent to you, including when they were sent. These records are retained until they are deleted by ERC or you request their deletion.

Some things are kept for longer, on purpose:

• Finalised recruitment minutes. These are the formal record of how a recruitment was decided and who was considered. They still name candidates, because that is the point of them. They are kept even after a candidate's other information is removed.
• The audit log, which records sensitive actions. Rewriting an audit trail to remove someone would defeat its purpose. Access to it is restricted.
• The record of decisions - which stages an application reached, when, and who moved it - even after your name has been removed from it.

Finalised recruitment minutes and the audit log are kept for upto 10 years starting from the closure of a vacancy.

8. What happens when you ask us to delete your account?

You can delete your account yourself from your account pages. There is a confirmation step, and it tells you plainly what happens, including what survives.

Deleting your account means we anonymise it rather than erase every trace of it. In practice:

8.1. Removed:

• your name, your email address (including the address you registered with), your password and your profile picture;
• your phone number, country and skills;
• your education, employment and language entries;
• your CV and every supporting document you uploaded - including older versions of files you replaced;
• the answers you typed into application forms, and the form submissions themselves;
• the email address and the text of the messages we sent you.

You are logged out, the account is blocked, and it cannot be logged into again.

8.2. What we keep and why :

• The shape of the recruitment record - that an application existed, which stages it reached, when, and which ERC staff moved it. This is how we stay accountable for how we recruit. It no longer says who it was about.
• Assessments and recommendations written by reviewers, with your name removed from them. They are evidence of how a decision was made.
• Finalised recruitment minutes, which still name you. They are a formal record and cannot be rewritten afterwards. The deletion confirmation says this explicitly, so you know before you confirm.
• A document that finalised minutes refer to, if any - so that the minutes do not end up pointing at nothing.
• The audit log, entries created before your account is deleted may retain your name as part of the historical record.

Because your agreement ("consent") is the basis on which we hold your information, withdrawing that agreement means deleting your account. There is no separate "untick the box" option, because leaving your information in place after you had withdrawn your agreement would be a contradiction.

Two situations where self-service deletion is refused, with an explanation:

• if your account also has an ERC staff role (for example if you both applied for one role and sit on another role’s interview panels) - deleting it would remove your colleague access as well, so this has to be handled by an administrator;
• if the account has already been anonymised.

An ERC administrator can also anonymise an account on request, through exactly the same process, so the result is the same either way.

9. How anonymisation works?

Anonymisation means we keep the record and remove the person from it.

• Your account is renamed to a neutral placeholder such as DeletedUser12 - the exact wording is configurable by ERC - and your identifying details are cleared.
• The record itself stays, so that a recruitment we ran can still be explained and checked.
• Coded, non-identifying details may stay - for example the level of study, the hours someone was available for, or whether screening was passed. These are used for counting and reporting and do not identify anyone.
• Files cannot be anonymised. A CV contains your name, your address and sometimes your photograph inside the file itself, and we cannot rewrite that. So documents are deleted, not anonymised - including older versions.
• Anonymisation happens in two situations: when a whole account is deleted, and when a single old application reaches the end of its retention period. The second only touches that one application. If you have an old application from years ago and a live one from last week, only the old one is affected.
• Each anonymisation is recorded in the audit log, noting what was cleared - never what it contained.

Free-text assessments written by ERC HR staff, hiring manager or hiring panel member in the status history are not cleared when a candidate is anonymised.

10. Your rights.

Under the EU General Data Protection Regulation (GDPR), you have the right to be informed about how your personal data is used, to request access to it, to correct inaccurate or incomplete data, and, in certain circumstances, to request its erasure or restriction of its use. You also have the right to receive data you provided in a reusable electronic format and to object to processing based on legitimate interests. These rights are subject to the conditions and exceptions in GDPR Articles 15–21.

Where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before you withdrew consent (GDPR Article 7(3)). You also have rights concerning a decision based solely on automated processing if it has a legal or similarly significant effect on you (GDPR Article 22).

We will respond to a request to exercise your rights without undue delay and within one month of receiving it. If necessary because a request is complex or we have received numerous requests, we may extend this period by up to two further months. We will tell you within the first month and explain the extension (GDPR Article 12(3)).

If you believe our use of your personal data breaches the GDPR, you may lodge a complaint with a data protection supervisory authority, particularly in the EEA country where you live, work, or believe the breach occurred (GDPR Article 77). You can find the relevant authority through the European Data Protection Board’s directory.

What the platform gives you today:

11. About the copy of your information.

The downloadable copy contains what you gave us and what the platform holds about your applications. It does not include:

• assessments and reviews written about you (a review identifies its author as much as it identifies you) - the copy tells you how many exist;
• finalised recruitment minutes, because they name other candidates too;
• interview notes, references and other documents ERC staff added about you;
• comments staff wrote in the status history, and the internal judgements behind screening.

The file says clearly that it is holding these back, rather than leaving them out quietly. If you want to know more than the file contains, contact us and we will deal with it as a request rather than as a download - see below.

Every time a copy of someone's data is produced, that is recorded in the audit log, including who produced it and which sections it contained - never the contents themselves.

12. How to contact us?

For privacy questions or requests concerning your personal information, contact ERC’s Data Protection Expert, Gaurav Singh Basnyat, at dpo@pagulasabi.ee.

To submit a complaint, contact ERC’s Registrar of Complaints and Feedback through cfm.pagulasabi.ee(Opens in a new tab/window) or by email at complaint@pagulasabi.ee.

13. Other things worth knowing before you register or apply.

• You need an account to apply. Applications are tied to your account so that you can see the status of each one.
• You must agree to us processing your information in order to register. You cannot create an account without it. We record the date you agreed. Once given, the agreement cannot be quietly changed - withdrawing it means deleting your account.
• One profile, many applications. Your profile is reused, so you do not upload the same CV again for each role. That also means updating your profile updates what future applications are built from.
• Applications are separate from your profile. Withdrawing or deleting one application does not delete your profile or your account.
• Be careful what you put in free-text answers and in your CV. Please only include information that is relevant to the role. In particular, think twice before including sensitive personal information you have not been asked for, such as health details or identity document numbers, unless the opportunity specifically asks for them.
• Staff can see previous applications you have made to ERC where they are allowed to see those records, so your application history is visible to the recruitment team.
• Some opportunities require documents that need special handling, such as identity documents or background checks. Where these are needed, they are stored with extra restrictions.
• We may write to you about your application. Messages come from approved templates, in your language, and each one is recorded.
• This platform is for recruitment. It is not used to contact you about anything else.

You may choose to allow ERC to retain your profile and CV to consider you for future vacancies and contact you about relevant opportunities by selecting an optional checkbox in your profile. This choice does not affect your current applications, and you can withdraw your consent at any time by contacting dpo@pagulasabi.ee.