Recruitment Privacy Notice

1. Who is responsible for your information

The controller of your recruitment information is SD IT Services SH.P.K. (business registration number 811923417), Rruga Medlin Ollbrajt, Gjilan 60000, Republic of Kosovo. In this notice, “SD IT Services”, “we” and “us” refer to this company.

For questions about this notice, and for any privacy request, contact us at info@sdit-services.com.

2. Information we collect

We may collect your name, email address, phone number, CV, cover note and other information you voluntarily provide as part of the application.

• The position you apply for, the date and time of your application, and the version of this notice you acknowledged.
• Whether you gave the optional future-opportunities permission, when you gave it, and whether you later withdrew it.
• A Cloudflare Turnstile security check of the submission, which uses technical information about your browser and connection, including your IP address, to block automated spam.
• To prevent abuse of the form, a pseudonymous identifier that changes every day and is derived from your network address. We do not store your IP address in our recruitment system.

3. Providing your information

You are not required by law to apply or to provide your information. To consider your application we need your first and last name, email address and phone number, and your acknowledgement of this notice; without them we cannot process it. Your CV and cover note are optional, and so is the future-opportunities permission.

4. How we use your information

• To assess your application for the position you applied for.
• To contact you about the recruitment process for that position.
• To manage the related Hiring records in our CRM.
• To protect the application form against spam and abuse.
• Only if you give the separate optional permission: to keep your CV and contact you about other suitable vacancies for up to 12 months.

5. Legal basis

We process recruitment information in accordance with Kosovo Law No. 06/L-082 on Protection of Personal Data.

• To consider your application and contact you about it, because you asked us to: this is necessary to take steps at your request before entering into an employment contract (Article 5(1.2)).
• To protect the application form against spam and abuse, on the basis of our legitimate interest in keeping the form secure (Article 5(1.6)).
• To keep an unsuccessful application for 6 months after the decision, on the basis of our legitimate interests in answering questions about the decision and in establishing, exercising or defending legal claims (Article 5(1.6)).
• To keep your CV and contact details for future vacancies, only on the basis of your consent, given with the separate optional box (Article 5(1.1)). You can withdraw it at any time; withdrawal does not affect processing before it.

6. Application response

We will provide an update on your application within 10 working days. If a final decision has not yet been made, we will provide a status update. Submitting an application does not guarantee an interview.

7. How long we keep your information

When we delete or reduce your information, we keep a minimal audit record of that action so that we can show we followed these rules. It contains only the date of the action and of the hiring decision, the position, internal reference numbers, technical details of how your application was processed, which version of this notice you acknowledged and when and, if you gave the optional permission, when it started and ended. If you made a privacy request, we also keep its type and dates. These audit records do not contain your name, contact details, CV or the content of your application, and we keep them only for as long as they are needed for that purpose. Any identifiable information we still hold about you for another purpose, such as another application, an active future-opportunities permission or an employment record, is kept and deleted under the rules for that purpose.

These are retention periods set by SD IT Services; they are not periods required by law. We keep information for longer only where applicable law requires it, or where it must be preserved for a legal claim or a legal hold, and only for as long as that obligation applies.

• While your application is being considered, we keep it until a hiring decision is made.
• If your application is unsuccessful, we keep the information from that application, including your CV, for 6 months after the unsuccessful hiring decision and then delete it at our next regular retention review. If you withdraw your application, the same period runs from the date you withdrew it.
• If you gave the separate optional future-opportunities permission, we keep your CV and the contact details we need to reach you for 12 months from the date you gave that permission, or until you withdraw it if that is earlier, and then delete them at our next regular retention review. This permission does not allow us to keep your complete original application, or to keep anything indefinitely: once the 6-month period above ends, we keep only your CV, those contact details and the date of the hiring decision, and only for this purpose.
• If you are hired, the recruitment records needed for your employment become part of your employment records, and we will inform you of the policy that applies to them when your employment begins.

8. Future opportunities (optional)

You may separately choose to allow us to retain your CV and contact you about other suitable vacancies for up to 12 months. This is optional and does not affect your current application. We record this permission only if you tick the separate box on the application form; we never assume it.

You can withdraw this permission at any time by emailing info@sdit-services.com. Once you withdraw it, or once 12 months have passed, we no longer contact you about other vacancies and no longer keep your CV for that purpose. Your current application is not affected.

9. Access and security

Your information is managed through our internal CRM and accessed only by authorized personnel and necessary service providers, subject to appropriate security and privacy controls. Within SD IT Services, only staff with recruitment (Hiring) permissions in the CRM can see applications and open CVs.

Our website does not keep a separate copy of your application. It sends your application to our CRM over an encrypted connection, signed so that the CRM accepts only genuine submissions from our website. Your CV is stored privately and is never published or made available through a public link.

10. Service providers

We use the following service providers to run our website and our recruitment system:

• Vercel, which hosts our website and our CRM.
• Neon, which hosts our CRM database in Frankfurt, Germany.
• Cloudflare, which provides the Turnstile security check on the application form. Cloudflare may also use the technical signals from that check (such as your IP address and browser details) to improve its bot detection, as an independent controller.
• Resend, which delivers the emails our CRM sends about applications.
• Google Workspace, which hosts our info@sdit-services.com mailbox and the calendar we use to send interview invitations (your name and email address appear on the invitation).
• Calendly, only if we invite you to book an interview time through a Calendly link; you then enter your details on Calendly directly.

11. International transfers

Our website’s application processing and our CRM run in Vercel’s Frankfurt, Germany region, and our CRM database, where your application and CV are stored, is hosted by Neon in Frankfurt, Germany.

Some processing still takes place outside Kosovo and the European Union. Requests reach our website through Vercel’s global network, and the Cloudflare Turnstile check runs on Cloudflare’s global network. Vercel, Cloudflare, Resend, Google and Calendly are based in the United States: Resend keeps its records of the emails it delivers for us in the United States, and these providers and their affiliates may access or process information in other countries, for example to provide support.

Germany, Ireland and the other EU and EEA states are on the Information and Privacy Agency’s list of countries that ensure an adequate level of data protection (Decision No. 22/2025). The United States is on that list in line with the EU-U.S. Data Privacy Framework, in which Vercel, Cloudflare, Databricks (Neon’s parent company), Resend, Google and Calendly participate. Some providers’ affiliates and sub-processors may access information from other countries, for example to provide technical support; for countries that are not on the Agency’s list, there is no adequacy decision by the Agency.

12. Your rights

Under Kosovo Law No. 06/L-082 on Protection of Personal Data you have the following rights, subject to the conditions and exceptions set out in that law:

• Access: to know whether we process your information and to receive a copy of it. The first copy is free; we may charge a reasonable administrative fee for further copies.
• Correction: to have inaccurate information corrected without undue delay.
• Deletion: to have your information deleted, unless we still need it, for example to comply with a legal obligation or to establish, exercise or defend legal claims.
• Restriction: to ask us to restrict the processing of your information in the cases set out in the law.
• Objection: to object, on grounds relating to your particular situation, to processing based on our legitimate interests.
• Data portability: where the law provides for it, to receive the information you gave us in a structured, commonly used and machine-readable format and to have it sent to another controller.
• Withdrawing your permission: to withdraw the optional future-opportunities permission at any time by emailing info@sdit-services.com. Withdrawal does not affect processing that took place before it.
• Automated decisions: we do not make decisions about applications based solely on automated processing. The automated security check only stops automated (bot) submissions; if it prevents you from applying, contact us and we will help.

13. Making a request or a complaint

Send any request to info@sdit-services.com. We may ask you to confirm your identity before we act on it. We respond without undue delay and within one month of receiving your request; for complex or numerous requests we may extend this by up to two further months, and we will tell you within the first month. Requests are free of charge, except where the law allows a fee or a refusal for manifestly unfounded or excessive requests.

If you believe your information has been processed in breach of the law, you can lodge a complaint with the Information and Privacy Agency (Agjencia për Informim dhe Privatësi), Rr. “Zejnel Salihu” No. 22, 10000 Prishtina, Republic of Kosovo, info.aip@rks-gov.net, https://aip.rks-gov.net.

14. Changes to this notice

Each version of this notice has a version identifier, shown at the top of this page, and our CRM records the version you acknowledged with your application. If we change this notice, we publish a new version.