Privacy policy
Effective date: February 2023
Last updated: 17 September 2026
We would love to answer any questions you may have regarding the processing of your personal data. The purpose of this Privacy Policy is to inform you of the measures we have
taken to ensure the highest possible level of privacy and protection of your personal data. It is intended to inform you about the processing and management of any personal data you
provide us with, the reasons why we collect it and how we ensure its security. This Privacy Policy has been written in accordance with the principles of the General Data Protection Regulation (“GDPR”). If, after reading this document, you still have questions, you can email us at help@careeros.com and we will happily respond. This policy explains what we collect, why, and on what legal basis.
General Overview
CareerOS is an integrated career development platform that connects students, university career advisors and employers. It is provided by Jobworx CareerOS SL, a company registered in Barcelona, Spain.
Who is responsible for your data
This is the most important thing to understand in this policy, because it decides who you go to about your data. CareerOS acts in two different roles depending on how you came to use it.
| If you are | Who is the controller | Our role |
|---|---|---|
| A student, alumnus or member of staff using CareerOS through your university or business school | Your institution | We are its processor. We handle your data on its documented instructions, under a Data Processing Agreement made with it under Article 28 GDPR. |
| Someone who signed up to CareerOS directly, without going through an institution | CareerOS | We are the controller and this policy governs your data in full. |
| An employer, recruiter or hiring manager using the employer platform | CareerOS | We are the controller, under our own contract with your organisation. |
| A professional contact a student has saved into their networking pipeline | CareerOS | We are the controller of that contact data. See “Networking contact data” below. |
What this means in practice:
● Most of what you might want, you can do yourself, in the product, whichever of us is the controller. You can view and correct your profile, export your data, and delete your account, from your profile settings. Deleting your account takes effect on its own: there is a four day window in which you can change your mind, and after that your data is erased. You do not need anyone's permission for this and you do not need to ask us.
● Where CareerOS is the controller, write to us for anything the product cannot do for you, using the contact details at the end of this policy, and we answer you directly.
● Where your institution is the controller, it decides. If you write to us about data we hold for your institution, and it is not something you can do yourself in the product, we will confirm we received your request, tell your institution promptly, and point you to its career services or data protection contact, since the decision is theirs to make. We help them answer you.
We are also the controller, whichever route you came by, when we process account, usage, product analytics and security information for our own purposes: running and securing the service, billing, preventing fraud and abuse, meeting our legal obligations, and improving the product.
If you graduate or otherwise leave your institution and choose to carry on using CareerOS as an individual, responsibility for your data moves from your institution to us at that point, and we will tell you when it does.
Scope
This Privacy Policy covers the personal data we process as a controller, and explains what we do with personal data we process on behalf of an institution. Where an institution is the controller, its own privacy notice applies alongside this one and takes precedence on anything it decides.
Type of Data Collected
For optimal results from our Service, we will ask you for some personal data. We may also process data about you provided by our partner Universities or from third data sources,
such as publicly available data or Linkedin data. Personal data we collect is data that personally identifies you, such as information in relation to:
● Your identity: surname(s), first name(s) and email address(es).
● Your professional profile:
○ For Students: your education history, your professional experience, your desired industry and job position, your preferred job type (in-person, remote, or hybrid), languages you speak, work authorizations.
○ For University Career Advisors: the name of your institution, your title.
○ For Employers: the name of your company, your title, student profiles you are looking forIn addition, we may also collect technical logs of your connection to our website (IP address, date and time of connection), browser type, and operating system.
CareerOS does not require special categories of personal data under Article 9 GDPR, and no part of the product asks you for them in order to work. Free-text fields, documents you upload and messages you synchronise may happen to contain such data because you chose to include it.
There is one place they are asked for directly. Where your institution runs a first-destination outcome survey through CareerOS, that survey may include optional questions on gender and ethnic background. Your institution is the controller of that survey and decides whether to ask them at all. Every question can be skipped, each is marked optional, and answers feed your institution's aggregate reporting. These fields are excluded from the data we make available to partners through our API.
Students who use the CareerOS Chrome Extension acknowledge that CareerOS stores LinkedIn profile information, including the content of LinkedIn messages between the Student and their saved CareerOS Contacts, so that the integrated networking feature can show a conversation history. This is kept for as long as the contact is saved: it is deleted when the Student removes that contact, and when the Student deletes their account. There is no separate expiry.
Purpose of Data Processing
Where your institution is the controller, it chooses the legal basis for the processing we carry out for it, and its own privacy notice sets that out. The table below is the basis we rely on where CareerOS is the controller, as described at the top of this policy. Each purpose has its own basis under Article 6 GDPR:
| Purpose | Legal basis |
|---|---|
| Providing the platform and its features to you | Performance of a contract (Art. 6(1)(b)) |
| Personalising your experience and suggesting jobs, companies and contacts that match your interests | Legitimate interests (Art. 6(1)(f)) |
| Communicating with you about the platform and providing support | Performance of a contract (Art. 6(1)(b)) |
| Improving the platform and developing new features | Legitimate interests (Art. 6(1)(f)) |
| Holding professional contact details of people students save into their networking pipeline | Legitimate interests (Art. 6(1)(f)), balanced against those people's rights |
| Keeping the service secure, preventing fraud and abuse, and meeting our legal obligations | Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) |
| Analytics and other non-essential cookies | Consent (Art. 6(1)(a)), given through our cookie banner |
| Meeting our legal and regulatory obligations | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have weighed those interests against your rights and you can object at any time using the contact details below. Where we rely on consent, you can withdraw it at any time, and doing so does not affect processing that already took place.
Automated Processing and Profiling
CareerOS uses automated processing to suggest jobs, companies and networking contacts, to rank candidate matches for employers, and to extract structured information from a CV you upload. Several features use AI to draft text or summarise information you have given us: CV assistance, career research, outreach drafting and the advisor help centre. These run on Google's Gemini models through Vertex AI in Google Cloud's EU regions, under Google Cloud's data processing terms. Your data is not used to train those models. Candidate matching for employers is a deterministic scoring engine rather than an AI model. These are suggestions and rankings: a person always decides whether to apply, whom to contact, and whom to interview. No decision producing legal effects or similarly significant effects on you is made solely by automated means within the meaning of Article 22 GDPR. You can turn job suggestions off in your account settings, and your profile is hidden from employers unless you switch employer visibility on.
Recipients of the Data
Personal data provided may be viewed by our employees, or any subcontractors of CareerOS, strictly in accordance with the purposes described in Article 4 above and on a
strict “need-to-know” basis. To guarantee you the best possible Service, we may share your personal information with third parties for the following purposes:
● With employers you have bookmarked or saved job postings for. We will share your contact information and other information you have provided to us with these companies to facilitate your job application process.
● With University Career Advisors. We will share an overview of your activity on CareerOS, namely which companies and industries you are engaging with on the platform, in order for your Advisor to give you the best possible, tailored advice.
● With service providers who help us operate our platform and provide our services. The sub-processors that handle data on behalf of your university are listed, with their hosting location and transfer safeguards, in our sub-processor list. Separately, we use Apollo, EnrichLayer, Jina and Firecrawl to enrich company and role information; these act as our own processors rather than your university's, and are not part of that list.
● With our affiliates, business partners, or investors in connection with a corporate transaction, such as a merger or acquisition.
● With law enforcement or other government agencies where we are legally required to do so. We do not hand over personal data to an authority voluntarily. Where an institution is the controller, we will tell it about the request unless the law forbids us, ask the authority to approach it directly, challenge a request we have reasonable grounds to consider unlawful, and disclose only the minimum the law requires.
Networking Contact Data
When a student saves a professional contact into their networking pipeline, and where we source or enrich professional contact information about people who are not students, alumni or staff of an institution, CareerOS is the controller of that contact data. It covers business contact details, employer, role and public professional profile information. The providers we use for that sourcing and enrichment are Apollo, EnrichLayer, Jina and Firecrawl; they act as our own processors, which is why they are not on the sub-processor list an institution receives. If you are such a contact and want to know what we hold or ask us to erase it, write to our Data Protection Officer using the details below and we will answer you directly.
Transfers Outside of the European Union
CareerOS is established in Spain and processes personal data primarily within the European Economic Area. The principal processing locations are the Google Cloud regions europe-west1 in Belgium, europe-west8 in Milan and europe-west3 in Frankfurt.
Where a provider we use is established outside the EEA, the transfer is made on one of these bases: a European Commission adequacy decision covering that country, including the United Kingdom decision of 28 June 2021; the EU-US Data Privacy Framework, where the provider is certified for the relevant category of data; or the European Commission's standard contractual clauses. The basis relied on for each provider is identified in our sub-processor list.
Storage Period
As part of the service we offer, we may be required to store the content that Users publish on CareerOS. We keep your personal data for as long as your account is open. You can delete your account at any time from your profile settings. Deletion runs on a four day grace period. For those four days the request can be cancelled from the link in the confirmation email. After it passes, a scheduled job removes your personal data from the platform database, from document storage, from our authentication provider and from our email delivery platform, and suppresses your address there. Your core record is anonymised rather than deleted, so that records which refer to it, such as cohort membership and event attendance, stay valid; the fields that identify you are removed. We keep a record that a deletion happened, and of the categories erased, as an accountability record. Backups follow their own rotation and are overwritten on that schedule. We do not currently delete accounts automatically for inactivity.
Security and Privacy
We maintain technical and organisational measures appropriate to the risk, as Article 32 GDPR requires. Personal data is encrypted in transit and at rest. Access is granted on a least-privilege basis, only to people who need it to do their job, and is withdrawn when they no longer do. Everyone we authorise to handle personal data is bound by confidentiality and trained for their role. We keep records of processing, and a data inventory covering processing activities, storage locations, retention and sub-processors.
Data Breaches
If a breach affects personal data we process for an institution, we notify that institution without undue delay, with enough detail for it to meet its own obligation to notify a supervisory authority or to tell you. Where CareerOS is the controller, we notify the competent supervisory authority without undue delay and, where the breach is notifiable, not later than 72 hours after becoming aware of it, and we tell affected individuals where the law requires it. We document every breach, what it affected and what we did about it.
To report a security vulnerability or a suspected breach, write to security@thecareeros.com rather than to general support. Our disclosure details are published at /.well-known/security.txt.
Terms and Exercise of Rights
In accordance with data protection regulation you have the right to access your personal data, to have it corrected, to have it deleted, to receive it in a portable machine-readable format, to object to processing based on legitimate interests, to ask for processing to be restricted, and to withdraw any consent you have given.
Start in the product. You can view and correct your profile, export your data, and delete your account from your profile settings, at any time and without asking anyone. Account deletion is reversible for four days and then erases your data. This is the fastest route and it covers most requests.
For anything the product cannot do, where to write depends on who controls your data, as set out at the top of this policy. If CareerOS is the controller, contact our Data Protection Officer at dpo@thecareeros.com and we will answer you within one month, telling you if we need longer. If your institution is the controller, its career services or data protection contact decides, so send the request there; if you write to us instead we will acknowledge you, tell your institution without undue delay, and help it answer. If you are not satisfied with the responses provided, you may lodge a complaint with a supervisory authority. Because CareerOS is established in Spain, our lead supervisory authority is:
Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6, 28001 Madrid, Spain
Phone +34 901 100 099
Web: www.aepd.es
You may also complain to the supervisory authority of the country where you live or work, whichever you prefer.
Data Protection Officer
Our Data Protection Officer and appointed EU Representative is:
Oleksii Reshetnik
dpo@thecareeros.com.
Passeig de Gracia 101, 3-3, 08008 Barcelona, Spain
Amendments of this Privacy Policy
We reserve the right to amend or to update this Privacy Policy. If we make substantial changes to the content of this Privacy Policy, those changes will be announced via a notice visibly displayed on the Platform or by other means, such as the email address you provided at the time of your registration. If you object to any changes, you may close your account.
Use of Cookies
Analytics and other non-essential cookies are only set if you accept them in our cookie banner, and you can change that choice at any time. For details of each cookie, please consult our Cookie Policy.