This privacy policy describes how Workmatch AB (“Workmatch”, “we”, “us”) processes personal data in accordance with the General Data Protection Regulation (GDPR). By using our platform, you accept this policy.

Data controller

1. What personal data we collect

Workmatch processes different types of personal data depending on the user’s role on the platform. Below is an overview of what data we collect:

1.2 Recruiters

To manage recruitment assignments and invoicing, we collect:

• Identity and contact details: name, email address, phone number
• Business information: company name, organization number, billing address
• User data: login information, user ID, system logs
• Activity data: created job ads, communication with candidates, booking history

1.3 Companies (employers)

To enable job advertising and management of recruitment processes, we process:

• Organization information: company name, organization number
• Contact details for responsible person: name, email address, phone number
• Billing information: billing address, purchase history, VAT registration number
• User behavior: views, clicks, advertising performance, interview bookings, statistics

2. How we collect personal data

Workmatch collects personal data both directly from you as a user and indirectly through your interaction with the platform. Collection occurs through the following methods:

2.1 Directly from the user

• During account registration: basic information such as name, email address and password is provided by the user.
• When completing the profile: e.g., CV, cover letter, education, work experience, work preferences, contact information.
• When uploading documents: such as certificates, grades, diplomas or a profile picture.
• When communicating through the platform: e.g., messages to employers or recruiters, answers to questions, forms or support requests.

2.2 Through use of the service

• User behavior: we collect data on how the user navigates and interacts with the platform, e.g., which job ads they click on, how often they log in, which jobs they search for or save.
• Cookies and tracking technology: information about your device, IP address, browser type, session data and preferences is recorded using cookies and similar technologies. These are used to improve the user experience and for anonymous statistics.
• System logs: each time you log in or interact with the platform, technical information is saved in log files for troubleshooting and security.
• Third-party analytics services: we may use tools (e.g., Google Analytics) to understand user behavior anonymously.

3. Why we process personal data (Purposes)

We process personal data to provide, administer and develop our services in a secure and efficient way. Processing is carried out for the following purposes:

3.1 To create and administer user accounts

• Register users as job seekers, recruiters or company representatives
• Ensure authentication during login
• Enable account settings management, profile information and notifications

3.2 To match candidates with relevant job ads

• Analyze user profiles, CVs and job-search behavior
• Use algorithms and recommendation systems to suggest suitable jobs
• Support recruiters in selection and filtering of candidates

3.3 To enable communication between users

• Provide users with a messaging system for direct contact
• Send automated reminders or status updates related to applications and job ads
• Facilitate booking interviews or other meetings

3.4 To handle payments, invoicing and contracts

• Administer purchases of job ads, recruitment services or premium features
• Ensure correct invoicing and bookkeeping in accordance with applicable law
• Identify buyers and ensure compliance with contract terms

3.5 To improve and develop the platform

• Measure user behavior to improve interface and functionality
• Follow up error reports and technical issues
• Carry out anonymized analyses and user surveys

3.6 To comply with legal obligations

• Comply with requirements under bookkeeping laws, tax legislation and other applicable regulations
• Handle requests from authorities
• Document consents, complaints or requests in accordance with GDPR

3.7 For AI training and service improvement

• User data may be used to train and improve our AI models, e.g., matching algorithms and automated recommendations.
• Data used for AI training are anonymized or pseudonymized where possible.
• Users can at any time choose not to participate in AI training via settings or by contacting us.

3.8 For social features and automatic AI-driven updates

• Provide social interaction, networking and communication between users on the platform
• Generate automatic updates and recommendations based on the user’s activity and preferences using AI
• Improve the user experience by personalizing content and notifications in real time

3.9 Notifications About Relevant Opportunities

When you register as a job seeker on Workmatch, one of the main purposes of your profile is for you to receive notifications about positions matching your profile, skills, and preferences. We send you:

• Notifications about new positions matching your profile
• Information from companies or recruiters wishing to contact you about specific positions via the platform’s messaging function
• Reminders about ongoing applications and status updates
• Summaries of new positions in your area or industry

This is a core part of the service you signed up for and is processed on the legal basis of contract (GDPR Article 6.1(b)) or legitimate interest (GDPR Article 6.1(f)).

You can turn off or adjust these notifications at any time in your account settings or unsubscribe completely from the platform. Each email notification also contains an unsubscribe link. Notifications relating to an ongoing application or communication with an employer may still need to be sent even if you have disabled other notifications, as long as the application remains active.

4. Legal basis for processing

All processing of personal data within Workmatch is based on at least one of the legal bases stated in the GDPR. These are:

4.1 Consent (Article 6.1(a) GDPR)

We process personal data based on the user’s explicit consent in the following cases:

• When the user registers and voluntarily fills in their profile
• When subscribing to newsletters or other voluntary communication services
• When allowing cookies for analytics or marketing (consent via cookie banner)

The user can withdraw their consent at any time via their account or by contacting us.

4.2 Contract (Article 6.1(b) GDPR)

Processing is carried out to fulfill our obligations under the agreement entered into between Workmatch and the user, e.g.:

• Provision of job matching services
• Access to the account and technical features
• Handling orders, payments and invoices

4.3 Legitimate interest (Article 6.1(f) GDPR)

We process certain data in order to:

• Protect the platform’s security and prevent misuse
• Improve and develop our services
• Communicate with users about relevant changes or news
• Carry out internal analysis and statistics (without identifying individual users)

We always carry out a balancing of interests to ensure that our legitimate interests do not override the data subject’s privacy.

4.4 Legal obligation (Article 6.1(c) GDPR)

We are obliged to process certain personal data to comply with legal requirements, including:

• Bookkeeping and accounting legislation (e.g., seven-year retention of invoice data)
• Requests from authorities or legal obligations
• Documentation of rights and complaints under the GDPR

5. Automated decision-making

Workmatch uses automated decision-making in the form of algorithmic matching, which means that the system analyzes information you provide (e.g., skills, experience, geographic location and preferences) to:

• Suggest relevant job ads to job seekers
• Suggest potential candidates to recruiters and employers

How matching works

• Matching is based on system logic and machine learning that weighs different factors, such as keywords, industries, location and profile completeness.
• The result is a list of recommendations presented to each user.

Important to know

• The automated decisions are not legally binding — there is no requirement to follow recommendations, and no legal consequences arise automatically.
• Matching is decision support, not a final decision-making tool. The employer or recruiter always makes the final decision on contact or employment.
• We do not carry out automated decision-making with legal or similarly significant effects under Article 22 GDPR without explicit consent.

Your ability to influence

● If you want to understand how the matching algorithm works or contest a specific decision (e.g., if you are not suggested for a certain role), you can contact us at info@workmatch.se. We offer the possibility of manual review.

6. Users’ rights under the GDPR

As a user, you have several rights under the General Data Protection Regulation (GDPR) that you may invoke at any time. Workmatch respects these rights and handles all requests in accordance with the law.

6.1 Right of access (Article 15 GDPR)

You have the right to receive confirmation of whether we process your personal data and access to the data, including:

• Which categories of data we process
• Where the data comes from
• Which recipients the data has been shared with
• The purpose of the processing

6.2 Right to rectification (Article 16 GDPR)

If you discover that any information is incorrect, outdated or incomplete, you have the right to request that it be corrected.

6.3 Right to erasure (Article 17 GDPR)

You have the right to request that your data be deleted, e.g., if:

• The data is no longer necessary
• You withdraw your consent and there is no other legal basis
• You object to the processing and there is no overriding legitimate reason to continue

Note! We may need to retain certain data if required by law (e.g., bookkeeping rules).

6.4 Right to restriction of processing (Article 18 GDPR)

You can request that we temporarily restrict the processing of your data, e.g., if you dispute the accuracy of the data or we are investigating a complaint.

6.5 Right to data portability (Article 20 GDPR)

You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to transfer it to another service.

6.6 Right to object (Article 21 GDPR)

You have the right to object to processing based on our legitimate interest, especially for direct marketing. In such case, we will stop the processing unless we have compelling legitimate grounds to continue.

6.7 Right to withdraw consent (Article 7 GDPR)

If our processing is based on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing already carried out.

6.8 Right to opt out of AI training

You have the right at any time to choose not to have your data used for AI training and model development. This can be done via your account settings or by contacting us at info@workmatch.io. After such a request, your data will be excluded from future AI training.

6.9 Right to limit AI-based social features

You can choose to limit or refrain from using social features such as automatic AI-driven updates via your account settings. You also have the right to request information about how AI analyses are used in social features and obtain manual review when needed.

How to exercise your rights

To exercise any of the above rights, you can contact us at:
Email: info@workmatch.io

7. Transfers to third parties & international transfers

Workmatch safeguards your personal data and shares it only with trusted parties when necessary to provide our services. We take technical, organizational and legal measures to ensure that transfers are lawful and secure.

7.1 Third-party providers (processors)

We use sub-processors (processors) for technical operations, payment services, communication tools and data storage. These may include:

• Cloud services (e.g., hosting and storage services)
• Payment service providers (for invoicing and payment handling)
• Technical operations partners (for support, email distribution and CRM)
• Analytics systems (for statistics and user behavior)

All providers are:

• Contractually bound through a data processing agreement
• Required to follow our instructions and applicable data protection laws
• Prevented from using the data for their own purposes

7.2 International transfers (outside the EU/EEA)

In some cases, your data may be transferred to or processed in countries outside the EU/EEA (“third countries”), e.g., if our sub-processor operates there.

Such transfers take place only if:

• The European Commission has decided that the country has an adequate level of protection, or
• Standard Contractual Clauses (SCC) under the European Commission’s decision are used, together with appropriate technical safeguards.

We regularly review our international transfers and take necessary measures to ensure your data is protected regardless of where it is processed.

8. Cookies & tracking

Workmatch uses cookies and similar technologies to improve your experience, understand how our service is used, and provide relevant content. Below we explain what cookies are, which types we use and how you can control their use.

8.1 What are cookies?

Cookies are small text files stored on your computer, tablet or mobile phone when you visit a website. They make it possible to recognize your device and collect information about your preferences and activities.

Cookies can be:
● First-party cookies (created by Workmatch)
● Third-party cookies (created by external providers, e.g., Google, Meta)

Cookies are divided into different categories based on purpose and functionality:

8.2 Types of cookies we use

Necessary cookies
● Required for the website to function correctly
● Enable features such as login, language selection and session management
● Cannot be turned off via the consent manager because they are technically necessary

Functional cookies
● Allow the website to remember your choices (e.g., username or region)
● Improve usability but are not strictly necessary
● Activated only with your consent

Analytics/performance cookies
● Collect anonymous statistics about how the website is used
● Help us understand user behavior, which pages are popular and whether errors occur
● Example: Google Analytics
● Activated only with consent

Marketing/advertising cookies
● Used to show relevant ads, both on Workmatch and on other websites
● Track user activity across different sites
● Used by e.g. Facebook Pixel and Google Ads
● Requires explicit consent under the ePrivacy Regulation

8.3 Cookie banner and consent

When you visit Workmatch’s website for the first time, a cookie banner is shown that:
● Informs about our use of cookies
● Gives you the option to accept, reject or customize which cookies you allow
● Is designed in accordance with GDPR and the ePrivacy Directive

Important:
● Non-essential cookies are not loaded until you have given your consent
● You can at any time change or withdraw your consent via our [cookie policy/link to settings]

8.4 How you control cookies

You always have the ability to manage cookies in the following ways:
● Via our cookie manager, where you can adjust your settings
● By adjusting your browser settings (e.g., block all cookies or delete existing ones)

Please note that blocking certain cookies may negatively affect website functionality.

8.5 Third parties and cookies

We sometimes use third-party services such as:
● Google Analytics
● Meta (Facebook Pixel)
● Hotjar

9. How Long We Store Data

• Active user accounts: as long as the account remains active
• Inactive accounts: 24 months after the last login, after which they are deleted or anonymized
• Applications for specific positions: 12 months after the position has been filled or closed
• Billing data: 7 years (in accordance with accounting laws)
• Communication via the platform: 36 months
• Cookies: according to cookie banner settings

10. Workmatch Is Not an Employer or Intermediary

Workmatch provides a technical platform enabling contact and collaboration between users. Workmatch is expressly not:

• An employer of job seekers, freelancers, or recruiters using the platform
• A client of recruiters taking assignments through the platform
• An intermediary, agent, or representative for any party entering into agreements through the platform
• A payment processor or paymaster for compensation between users

When a company and a recruiter or freelancer enter into an agreement via the platform, that agreement is made directly between those parties. Workmatch is not a party to the agreement and has no obligation to fulfill either party’s commitments.

10.1 Tax and Fee Responsibility

Each user is fully responsible for:

• Paying income tax, social security contributions, VAT, and other taxes or fees resulting from their activity on the platform
• Holding the correct business structure and tax registration (F-tax, A-tax, VAT registration, or equivalent) required for their use of the platform
• Issuing correct invoices and maintaining accounting records in accordance with applicable law
• Declaring income and fulfilling reporting obligations to the Swedish Tax Agency and other authorities

Workmatch does not withhold, pay, or report taxes, social security contributions, or other fees on behalf of users. Workmatch does not issue employment contracts, employer certificates, or similar documents.

10.2 Requirements for Recruiters and Freelancers

Recruiters and freelancers using the platform for paid assignments must:

• Hold a valid F-tax certificate or equivalent, or operate through a registered company with F-tax
• Be able to provide proof of their tax and business status upon request
• Ensure compliance with all legal requirements for conducting freelance or recruitment work in Sweden

Workmatch reserves the right to request documentation to verify this and suspend users who do not meet the requirements.

10.3 Company Responsibility When Hiring

Companies hiring recruiters or freelancers via the platform are themselves responsible for verifying the counterparty’s tax status and business structure before payment. The company is responsible for any consequences if the counterparty lacks F-tax status or if the relationship is deemed an employment relationship by the Swedish Tax Agency or another authority.

10.4 Recruiters

Third parties, such as staffing or recruitment agencies or independent recruiters, who:

• Use the platform to manage assignments from their clients
• Publish advertisements, search for candidates, review profiles, and schedule interviews
• Handle invoicing through the system in accordance with their own customer agreements

Recruiters must have F-tax status or operate through a registered company with F-tax. Recruiters are solely responsible for all tax payments, social security contributions, and accounting related to their income from the platform. Workmatch is not the employer of recruiters and does not withhold taxes on their compensation.

11. Who Can See Your Profile — and What They See

When you register as a job seeker on Workmatch, one of the main purposes is for your profile to be discoverable by relevant employers and recruiters. Here we explain exactly who sees what, and when.

11.1 Default Setting for Registered Job Seekers

When you register your account, your profile becomes searchable for verified companies and recruiters logged into Workmatch. This is the basis for the platform being able to match you with relevant positions.

Your profile is not publicly searchable on the internet and is not indexed by Google or other search engines. Only registered and verified users of Workmatch (companies and recruiters) can see your profile.

11.2 What Companies and Recruiters Can See About You

Before you have applied for a specific position or responded to contact:

• Name
• Profile picture (if uploaded)
• Professional role and seniority level
• Skills, languages, and certifications
• Work experience and education
• Geographic work region (e.g., "Stockholm" — not exact address)
• CV and any uploaded attachments
• General availability and salary expectations if provided

11.3 What They Cannot See Before You Apply or Respond

• Your exact postal address
• Your phone number
• Your private email address

11.4 Communication Through the Platform

Companies and recruiters can contact you via the platform’s internal messaging system. Your contact information (phone number and email address) is not automatically shared — messages are routed through Workmatch until you choose to respond or apply.

11.5 When Your Contact Information Is Shared

Your email address and phone number become available to a specific employer or recruiter when you:

• Apply for a position they advertised, or
• Actively respond to their contact and continue a recruitment dialogue

This occurs on the basis of contract — you have chosen to proceed in a recruitment process and thereby share your contact information with the specific counterparty. Your exact postal address is only shared if you choose to include it in your application or communication.

11.6 What the Other Party Does With Your Data After Sharing

Once an employer or recruiter has received your profile or contact information — either because you applied or responded to their contact — they become independently responsible for the personal data they process for their own recruitment purposes. This means:

• They are responsible for how long they store your data in their own systems
• They are responsible for their own communication with you after contact has been established
• Requests for deletion or correction must be directed to the respective company or recruiter

Workmatch requires all companies and recruiters using the platform to comply with GDPR in their handling of candidate data, but cannot guarantee their compliance after the data has left the platform.

11.7 Verification of Companies and Recruiters

Before a company or recruiter gains access to candidate profiles, Workmatch verifies that they are legitimate organizations with proper registration. This reduces — but does not completely eliminate — the risk of misuse. If you feel you have been contacted by a user who does not appear legitimate, report it directly to us at info@workmatch.io.

11.8 Your Control

You may at any time in your account settings:

• Delete your profile

When you delete your account, your profile data is deleted or anonymized within 30 days. However, information already shared with specific companies or recruiters remains with them — you must contact them directly to request deletion there.

12. Age Requirement

To register an account on Workmatch as a job seeker, freelancer, or recruiter, you must be at least 18 years old. Company representatives must also be at least 18 years old and authorized to represent the company. Workmatch is not directed at minors and does not knowingly collect personal data from individuals under 18 years old. If we become aware that we are processing data from a minor, the account will be closed and the data deleted.

13. When You Delete Your Account

When you choose to delete your account:

• Your profile and all profile data are deleted or anonymized within 30 days
• You will no longer appear in search results or matches
• Ongoing applications will be marked as withdrawn

Important to know: Information already submitted as applications to specific companies or recruiters remains with them. They are independently responsible for their own copy of your application. To request deletion from a specific employer, you must contact them directly. Workmatch can, upon request, help identify which companies have received your profile or application.

14. Contact us

For questions or complaints regarding data protection:
Email: info@workmatch.io