Privacy policy for our Career Site
Date of publication: 22 August 2025
We at Backlight manage our employer branding and recruitment process through our Career Site (the “Career Site”), and by using a related applicant tracking system.
In this privacy policy, we explain how we process your personal data if:
You visit our Career Site (you being a “Visitor”)
You connect with us via our Career Site, to create a profile with us and receive information about current or future vacancies with us (you being a “Connecting Candidate”)
You apply for a position with us, via our Career Site or a third party service (you being an ”Applying Candidate”)
We collect information about you from other parties, sites and services, since we believe your profile is of interest for our current or future vacancies, after initial contact and acceptance of an invitation to discuss further (you being a “Sourced Candidate”)
We receive information about you from our employees or partners, since they believe your profile is of interest for our current or future vacancies (you being a “Referred Candidate”)
We receive information about you from a Candidate, who lists you as their reference (you being a “Reference”).
This privacy policy also describes what rights you have when we process your personal data, and how you can exercise these rights.
When we use the term “Candidate” in this privacy policy, we are referring to each of Connecting Candidates; Applying Candidates; Sourced Candidates; and Referred Candidates, unless it’s stated otherwise.
This policy applies specifically to our recruitment activities. For information on how we process personal data on our main website, please see our general Privacy Policy.
1. About processing of personal data
Personal data is all information that can be directly or indirectly linked to a living, physical person. Examples of personal data are: name, e-mail address, telephone number and IP address. Processing of personal data is any automated use of personal data - such as collecting, creating, analyzing, sharing, and deleting personal data.
There are laws and regulations on how companies may process personal data, so-called data protection laws. Different data protection laws apply to different types of use of personal data, and in different parts of the world. An example of a data protection law that is relevant for our use of your personal data, as described in this privacy policy, is the EU Data Protection Regulation (2016/679, “GDPR”).
Most obligations under the GDPR apply to the so-called data controller. A data controller is the entity that decides for which purposes personal data will be processed, and how the processing will be executed. The data controller can use a so-called data processor. A data processor is an entity that is only allowed to process personal data as instructed by the data controller, and may not use the personal data for its own purposes.
We are the data controller when we process your personal data as described in this Privacy policy.
2. What personal data do we process?
All individuals
Device information - If you visit our Career Site, we will collect information about your device, such as IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, geographic location, operating system and device settings/usage.
Technical and statistical data - If you visit our Career Site, we will collect technical and statistical data about your use of the site, such as information about which URLs you visit, and your activity on the site.
Communications data - We will collect and store your communication with us, including the information you provided in the communication. This may include the content of emails, video recordings, messages on social media, the information you add to your account with us, surveys, etc.
Contact details - Such as your name, email address, telephone number and physical address.
Candidates
Data from interviews, assessments and other information from the recruitment process - Such as notes from interviews with you, assessments and tests made, salary requirements.
Information in your application - Such as your CV, cover letter, work samples, references, letters of recommendation and education.
Information in your public profile - Meaning the information we collect about you from public sources related to your professional experience, such as LinkedIn or the website of your current employer.
Information provided by references - Meaning the information we receive from our employees or partners who refer you to us, or by the persons you have listed as your references.
3. Where do we receive your personal data from?
All individuals
From the Career Site. If you visit our Career Site, we collect technical and statistical information about how you use the Career Site, and information from your device.
Directly from you. Most of the information we process about you, we receive directly from you, for example when you apply for a position with us or connect with us. You can always choose not to provide us with certain information. However, some personal data is necessary in order for us to process your application or provide you the information you request to get from us.
References
Candidates
From public sources. We may collect personal data about you from public sources, such as LinkedIn or the website of your current employer.
From our references. We may receive information about you from our employees or partners (such as recruitment service providers), when they believe your profile is of interest for our current or future vacancies.
From your references. If you provide us with references, we may collect information about you from them.
Data we create ourselves or in cooperation with you. Information about your application and profile is usually created by us, or by us in cooperation with you, during the recruitment process. This may for example include notes from interviews with you, assessments and tests made.
4. For what purposes do we process your personal data?
Protect and enforce our rights, interests and the interests of others, for example in connection with legal claims.
Affected individuals: The individual(s) affected by the legal issue - this may include persons from all categories of individuals listed above.
Categories of personal data used: All the categories of personal data listed above can be used for this purpose.
Share your personal data with other recipients, for the purposes mentioned in Section 5 below.
Affected individuals: Varies depending on the purpose of the sharing, see Section 5 below.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Collect information about your use of the Career Site, using cookies and other tracking technologies, as described in our Cookie Policy.
Maintain, develop, test, and otherwise ensure the security of the Career Site.
Analyse how the Career Site and its content is being used and is performing, to get statistics and to improve operational performance.
Provide you with updates about vacancies with us.
Review profiles and applications sent to us. This also includes communicating with you about your application and profile.
Collect and evaluate your professional profile on our own initiative. This also includes communicating with you regarding your profile.
Contact you directly about specific, future vacancies with us.
Record the interview(s) with you.
Contact you to ask for your participation in surveys
Contact you to ask you to provide information about a Candidate, and evaluate the information you provide.
5. Whom do we share your personal data with?
Our service providers. We share your personal data with our suppliers who provide services and functionality in our employer branding- and recruitment process. For example, this includes recruitment service providers and the supplier of our Career Site and related applicant tracking system.
Companies providing cookies on the Career Site. If you consent to it, cookies are set by other companies than us, who will use the data collected by these cookies in accordance with their own privacy policy. You can find information about which cookies this applies to in our Cookie Policy.
To authorities and other public actors - when we are ordered to do so. We will share your personal data with authorities and other public actors when we have a legal obligation to do so.
To parties involved in legal proceedings. If needed to protect or defend our rights, we share your personal data with public authorities or with other parties involved in a potential or existing legal proceeding. This can for example be in case of discrimination claims.
Mergers and acquisitions etc. In connection with a potential merger, sale of company assets, financing, or acquisition of all or part of our business to another company, we may share your personal data to other parties involved in the process.
6. Legal Bases for Processing Personal Data
To lawfully process your personal data, a valid legal basis, as stipulated by the GDPR, is required.
The primary legal basis for processing your personal data, as outlined in this Privacy Policy, is your explicit consent. This consent is secured either upon your engagement with us (as a Visitor or Connecting Candidate) or subsequent to your agreement to proceed with discussions following initial contact with our Recruiting Team.
For further details regarding the assessment of this legal basis, please refer to Sections 9 and 10 for our contact information.
In specific circumstances, data processing may be contingent solely upon your provision of consent. An example of this is the proposed recording of an interview with you. Please consult Section 9 for additional information concerning your right to withdraw consent.
7. When do we transfer your personal data outside of the EU/EEA, and how do we protect it then?
As a global entity, we may process your personal data outside of the EU/EEA. We also engage with suppliers whose parent company, or whose subcontractor’s parent company, is based outside the EU/EEA. In such instances, we have considered the risk that personal data may be disclosed to countries outside the EU/EEA, for example, due to an authority request.
When we, or one of our suppliers, transfer your personal data outside the EU/EEA, we will ensure that a safeguard recognized by the GDPR is used to enable the transfer. We use the following safeguards:
When your personal data is transferred outside the EU/EEA, we also implement appropriate technical and organizational safeguards, to protect the personal data in case of a disclosure. Exactly which protective measures we implement depends on what is technically feasible, and sufficiently effective, for the particular transfer.
If you want more information about the cases in which your personal data is transferred outside the EU/EEA you can contact us using the contact details in Section 9 and 10 below.
8. For how long do we keep your personal data?
All individuals
If we process your personal data for the purpose of being able to protect and enforce our rights, we will keep your personal data until the relevant legal issue has been fully and finally resolved.
Visitors
We keep your personal data for one (1) year for security purposes. The retention periods for cookies are set out in our Cookie Policy. We keep your personal data to analyse the performance of the Career Site for as long as we keep personal data about you for other purposes.
Candidates
If you are a Connecting Candidate (only), we keep your personal data for as long as you remain connected with us.
For all other candidate types, personal data is retained to assess suitability for relevant vacancies. Data retention will not exceed six months, after which profiles will be deleted under various circumstances (e.g., removal request, lack of consent). Should your application not be successful in the initial recruitment phase, your personal data will not be retained unless you have provided consent to be considered and contacted for pertinent future job opportunities.
If you are hired, we will keep your personal data during your employment, for other purposes than those stated above, which you will be informed of.
References
We keep your personal data for as long as we keep the personal data of the Candidate for whom you acted as a reference.
9. What rights do you have, and how can you exercise them?
In this section, you will find information about the rights you have when we process your personal data. As described below, some of the rights only come into play when we process your personal data under a particular legal basis.
If you want to exercise any of the rights listed here, we suggest that you:
Visit the Data & Privacy page on our Career Site, where we offer features to let you exercise your rights;
Log in to your account with us, where you can use the settings in the account to exercise your rights; or
Contact us directly at dpo@backlight.co.
Right to be informed
You possess the right to be informed regarding the processing of your personal data. Furthermore, you are entitled to be informed if we intend to process your personal data for any purpose divergent from its original collection.
Such information is provided to you via this privacy policy, through updates on our Career Site (please refer to Section 11 below), and by addressing any inquiries you may have for us.
Right to access your personal data.
You are entitled to ascertain whether their personal data is being processed by us and to obtain a copy of such data. Concurrently, upon receipt of said copy, comprehensive information detailing our data processing methodologies will be provided.
Right to access and to request a transfer of your personal data to another recipient (“data portability”).
You are entitled to request a copy of your personal data, processed by us for contractual performance or based on your consent, in a structured, commonly used, and machine-readable format. This enables the portability of your data, allowing for its transfer to another recipient. Furthermore, if technically feasible, you may request that we directly transmit your data to an alternative recipient.
Right to have your personal data deleted (“right to be forgotten”).
In certain circumstances, you possess the right to request the deletion of your personal data. This right applies, for instance, if the processing of your data is no longer necessary for the purpose for which it was originally collected, if you withdraw your consent, or if you have legitimately objected to the processing and there are no overriding justifications for its continuation. (For information regarding the separate right to object, please refer to the section below.)
Right to object against our processing of your personal data.
You have the right to object to the processing of your personal data when it's based on our legitimate interest. To do so, you must provide specific personal reasons for your objection. We will then stop processing your data unless we have compelling legitimate grounds that override your interests or for legal claims. We will explain our decision clearly.
Right to restrict processing.
Should you believe that the personal data we process concerning you is inaccurate, that our processing is unlawful, or that the information is no longer required for a specific purpose, you are entitled to request a restriction of the processing of such personal data. Furthermore, should you object to our processing, as described above, you may also request us to restrict the processing of that personal data while we conduct an assessment of your request.
When the processing of your personal data is restricted, we shall (with the exception of storage) only process the data with your consent or for the establishment, exercise, or defence of legal claims, to safeguard the rights of another natural or legal person, or for reasons pertaining to a significant public interest.
Right to rectification.
You have the right to request that we rectify inaccurate information, and that we complete information about you that you consider incomplete.
Right to withdraw your consent.
When the processing of your personal data is based upon your consent, you retain the prerogative to retract said consent at any juncture. Upon such retraction, we shall cease the processing of your data for the specific purposes for which consent was rescinded. Nevertheless, such retraction shall not invalidate the lawfulness of any processing conducted prior to its withdrawal.
Right to raise a complaint.
You retain the right to file a complaint with your national data protection authority.
For individuals located in the EU: You may contact the data protection authority in your Member State of residence, place of employment, or where the alleged infringement occurred. Each EU Member State maintains a supervisory authority responsible for enforcing the General Data Protection Regulation (GDPR), with a comprehensive list available here. For individuals located in the UK: You may lodge a complaint with the Information Commissioner's Office (ICO), which serves as the UK's independent authority established to uphold information rights in the public interest. Further information is available here. For individuals located in the US: While the US does not possess a singular federal data protection authority akin to those in the EU or UK, recourse may be available through state-specific data protection legislation or federal agencies such as the Federal Trade Commission (FTC) for certain categories of data privacy concerns. It is advisable to ascertain the pertinent authority or legal avenues based on your specific state and the nature of the data processing in question.
10. Where can you turn with comments or questions?
Should you wish to exercise your rights or have any inquiries, comments, or concerns regarding our handling of your personal data, kindly contact us via email at dpo@backlight.co.
11. Updates to this Privacy policy
This privacy policy is subject to updates as necessary, for instance, when new methods of personal data processing are introduced, to enhance clarity of information, or to ensure compliance with applicable data protection laws.
We recommend checking this page periodically for any revisions. The date of the most recent update to this privacy policy is consistently displayed at the top of this page.
