- We collect only information connected to the service, recruitment, security and billing.
- We do not sell personal information. Optional analytics is activated only with consent.
- You can request access, correction or deletion and exercise your other statutory rights.
1. Controller, contact and roles
The controller for Vinn.is account, service, security, billing and consent information is Vinn.is.
Privacy enquiries and requests may be sent to hallo@vinn.is.
A company is generally an independent controller for its recruitment decisions and its use of applicant information. Where Vinn.is stores and organises applications on the company’s instructions, Vinn.is may act as a processor for that part of the service.
2. Information we process and where it comes from
Account and contact information
Name, email address, password hash where applicable, email-verification status, preferred language, account role and identifiers for a selected Google or Facebook sign-in.
Candidate and application information
Profile, CV, contact details, skills, preferences, saved jobs, application answers, messages, interview information and application status.
Company and billing information
Company name and registration number, organisation units, employer users, roles and unit permissions, email-verification and benefit status, listings, billing entries, invoice references and relevant communication.
Technical and usage information
Session and security logs, device and browser category, language, referring domain, campaign labels and, with consent, a first-party visitor identifier, visited paths and an approximate country, region or city derived locally from the IP address. Raw IP addresses are not stored in analytics reports; IP addresses and user-agent strings may be hashed for security and data quality.
Most information comes directly from you or from an employer user acting for a company. If you choose Google or Facebook sign-in, the selected provider supplies your provider identifier, name and email address. Technical information is generated when the service is used. Application status and interview information may be added by the relevant company.
3. Purposes and legal bases
4. Applications and recruitment information
When you submit an application through Vinn.is, the relevant legal entity and authorised users for the publishing unit receive the profile information, CV, answers and message selected for that job. A main administrator may be given company-wide applicant access, while unit users receive it only when explicitly authorised. The company can then record internal notes, tags, interview details, messages and progress.
Job seekers should not include information about health, ethnicity, political opinions, religion, trade-union membership, sexual orientation, criminal matters or other sensitive circumstances unless it is clearly necessary and lawful for the particular application. Employers must not request or use such information without an appropriate legal basis.
If a listing uses an external application website or email address, the recipient controls that processing. Review the recipient’s privacy information before submitting personal information outside Vinn.is.
5. Recipients, processors and international transfers
Personal information may be disclosed to the company receiving an application, authorised employer users, and service providers that support hosting, email delivery, backups, security, file storage and technical operation. Information may also be disclosed where required by law, a lawful government request or the establishment, exercise or defence of legal claims. Personal information is not sold.
When you actively choose social sign-in, Google or Meta processes the authentication request under its own terms and privacy information. Vinn.is requests only the basic profile and email scopes needed to identify the account and does not store the provider access token after the sign-in request has finished.
Processors receive only the information needed for their task and are subject to appropriate contractual duties. If information is transferred outside the European Economic Area, Vinn.is uses a lawful transfer mechanism and appropriate safeguards. Information about current processors and transfer safeguards may be requested from the privacy contact.
6. Retention and security
Information is kept only for as long as it is needed for the purpose for which it was collected. The period depends on whether an account remains active, whether a recruitment process is ongoing, whether a company needs access to its records, statutory accounting requirements, security needs and applicable limitation periods. When information is no longer needed, it is deleted or anonymised unless continued retention is required by law or for legal claims.
CV files are stored outside the public web directory and delivered through access-controlled routes. Passwords and one-time tokens are stored as cryptographic hashes. Vinn.is uses technical and organisational safeguards appropriate to the nature of the information and the risk, but no online service can guarantee absolute security.
7. Your rights and how to exercise them
Subject to the conditions in data-protection law, you may request access to your information, correction, deletion, restriction of processing or data portability. You may object to processing based on legitimate interests and withdraw consent at any time. Withdrawal does not affect processing carried out before it. You may also request information about the balancing of interests used for relevant processing.
Candidate account holders can download a machine-readable copy of their account information and request deletion from account settings. A deletion request has a 14-day cancellation period. When it takes effect, the candidate profile and direct account identifiers are deleted or anonymised and active applications are withdrawn. A company may still need to retain limited recruitment records for its legal obligations or legal claims.
Send a request to the privacy contact above and describe what it concerns. We may need to verify your identity before responding. If the request concerns how a company uses an application after receiving it, you may need to contact that company directly; Vinn.is will help identify the correct recipient where reasonably possible.
You may lodge a complaint with the Icelandic Data Protection Authority, Persónuvernd, at personuvernd.is.
8. Automated decisions, children and changes
Vinn.is does not make solely automated decisions about job seekers that produce legal or similarly significant effects. Rule-based recommendations may affect the order in which jobs are shown, but companies make all recruitment decisions.
The service is intended for people legally able to seek employment and for authorised employer representatives. If information about a child has been submitted without an adequate basis, contact us so it can be reviewed.
This policy may be updated when the service, processing activities or legal requirements change. Material changes will be marked with a new effective date and communicated separately where appropriate.