Privacy Policy

1. Who we are

WeTal Lab AB ("WeTal", "we", "us", "our"), registration number 559215-2465, registered address Bondegatan 45, 116 33 Stockholm, Sweden, is the data controller for the personal data described in this Privacy Policy. WeTal operates a platform that connects IT consultants and candidates with companies for recruitment and staffing purposes (the "Platform"). If you have questions about this Policy or how we handle your personal data, contact us at info@wetal.com.

2. Who this Policy applies to

This Policy covers three groups of people whose personal data we process, and the rest of this document is organised around that distinction because the data we collect, our legal basis for processing it, and your rights differ between them:

• Candidates and users — people who create an account on the Platform to apply for roles, build a profile, or represent a company on the Platform.
• Company contacts — individuals at companies that use WeTal to source candidates.
• Prospects and leads — business contacts we have not yet built a relationship with, whose details we hold for sales and marketing outreach. We generally do not collect this data directly from the individual.

3. Personal data we collect

Account and profile data. When you register and use the Platform we collect:

• Identity and contact details: name, email address, phone number.
• Account credentials: your password, stored as a salted hash, never in plain text.
• Profile content: profile picture, CV/resume and any documents you upload, work experience, education history, skills, languages, seniority level, desired role, salary expectations, location, and visa/work-permit status.
• Company data: for company users, the company name, logo, description, images, and billing/outsourcing status.
• Communications: messages you send through the Platform and correspondence with our support team.
• Automatically collected data: device and browser information, IP address and general device identifiers used for fraud prevention and diagnostics, login and session history, push-notification tokens, and cookies.

4. Prospect and lead data (not collected from you directly)

Separately from Platform accounts, WeTal maintains records of business contacts — prospective client companies and their representatives — who have not registered on the Platform. This data typically includes name, business email address, job title, employer, and, where relevant, information from public sources. We use this data for direct sales outreach and relationship management, and we track engagement with our emails (opens and clicks) to gauge interest.

Because this data is not collected from you directly, Article 14 of the GDPR applies: we aim to inform affected individuals of this processing, our legitimate interest basis for it, and their right to object, at the point of first contact or in this Policy. If you are a prospect or lead and want to know what data we hold about you, or want us to stop contacting you, email info@wetal.com and we will action this without requiring you to create an account.

5. Why we process your data and our legal basis

• Providing the Platform and matching candidates with opportunities — performance of a contract with you.
• Account security, fraud prevention, and service diagnostics — our legitimate interest in keeping the Platform safe and functioning.
• Sales and business-development outreach to prospects and leads — our legitimate interest in growing the business, balanced against your right to object at any time.
• Sending you service communications and, where you have opted in, marketing communications — contract performance and consent respectively.
• Complying with accounting, tax, and other legal obligations — legal obligation.

6. Cookies and tracking technologies

We use strictly necessary cookies to keep you signed in and to secure the Platform. Where we use analytics or marketing cookies, or email-tracking pixels (for example, to see whether a sales email was opened), we will disclose this and, where required by Swedish law, ask for your consent through a cookie banner on first visit.

You can withdraw consent or change your browser settings at any time; blocking strictly necessary cookies may prevent you from logging in.

7. Who we share your data with

We share personal data with service providers who process it on our behalf ("sub-processors"), under written agreements that require them to protect your data and use it only for the purposes we specify. These include:

• Amazon Web Services (AWS) and Supabase — cloud hosting, database, and file storage.
• HubSpot — customer relationship management and marketing communications.
• A payment processor — to handle company subscription billing.
• Firebase — mobile push notifications, where applicable.
• Other analytics, email-delivery, or review-platform providers we engage from time to time.

8. International data transfers and retention

Our infrastructure is hosted within the EU/EEA. Where a service provider processes data outside the EU/EEA, we rely on the European Commission's Standard Contractual Clauses or another valid transfer mechanism, and we take additional safeguards where needed.

We keep account and profile data for as long as your account is active and for a reasonable period afterward to handle any disputes and comply with legal obligations. We keep prospect/lead data until you object or until we determine the contact is no longer relevant to our business, whichever is sooner. We delete or anonymise data once it is no longer needed for these purposes.

9. Security

We use industry-standard technical and organisational measures to protect your data, including encrypted connections, access controls restricting data access to authorised service accounts, and hashed password storage. No system is completely secure, and we encourage you to use a strong, unique password.

10. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Request erasure of your data, subject to legal retention requirements.
• Restrict or object to certain processing, including direct marketing at any time.
• Receive your data in a portable format, where technically feasible.
• Withdraw consent at any time, where processing is based on consent.

11. Complaints, children and changes

To exercise your rights, email privacy@wetal.com. If you are not satisfied with our response, you have the right to lodge a complaint with Sweden's data protection authority, Integritetsskyddsmyndigheten (IMY), at imy.se, or with the supervisory authority in your own EU/EEA country of residence.

The Platform is intended for people old enough to work or seek employment and is not directed at children. We do not knowingly collect personal data from children.

We may update this Policy from time to time. We will post the updated version here with a new effective date, and where changes are material we will take reasonable steps to notify you.

12. Contact us

WeTal Lab AB, Bondegatan 45, 116 33 Stockholm, Sweden — info@wetal.com