Privacy notice for customers and visitors
Last updated 30 September 2026.
This notice explains how we handle personal data about you when you visit hire.resumebanger.com or a page under /hire, or when you deal with us for your business. Other notices cover people we contact about our services and employees who use an Outplacement pack code. The CVs and files you send us are covered by our data processing agreement, because there we act for you.
1. Who we are
We are Pavel Valynets PR Beograd, trading as Resume Banger (Resume Banger Hiring), a business registered in Serbia, with our seat at Jurija Gagarina 231, 11073 Beograd. Contact: [email protected]. Our full details are on the company details page. We are the controller of the personal data in this notice.
We have not appointed a data protection officer, because the law does not require one for what we do, and, for the people this notice covers, we have no representative in the UK or the EU.
2. What we collect
- Contact details: your name, job title, business email address and company.
- What you tell us: your emails, your answers to our short follow-up questions, and any mistake you report.
- Order details: what you ordered, when, the price, and whether it was delivered.
- Free allowance: the free part of each service is shared by everyone at one organisation. We work out the organisation from the domain of your work email address (or, if we have none, of the company website), and we count the free applicants, CVs and codes used across all its links. For Shortlist we keep, per organisation, a one-way keyed fingerprint of each CV that was read for free, so that the same CV is not read for free twice. It cannot be turned back into the CV. It is deleted with the pile and in any case 7 days after it was made.
- Payment status: Creem tells us whether an order was paid and gives us a transaction reference. We never see your card details.
- Technical data: when you visit, your IP address and browser details reach Cloudflare and our server so that the page can be delivered and protected, and Cloudflare Web Analytics measures page loads in aggregate without cookies. Our server holds IP addresses only in memory, for at most a day, to limit repeated requests and to cap how many different companies start from one connection in a day. If a page fails in your browser, an error report goes to our own error tracker, set up to leave out your IP address, cookies, email addresses and private link secrets.
- Visit statistics: our own cookieless count of page views and steps, with no IP address, no user agent and no identifier, used only in aggregate. See our cookie notice.
3. Why we use it, and our legal basis
| Why | Legal basis |
|---|---|
| To deliver your orders: send you links, results and emails, and answer your questions | Our legitimate interest in dealing with the people who act for our customers (Article 6(1)(f)). If you are a sole trader, the contract with you (Article 6(1)(b)) |
| To keep order records and meet our legal duties, for example on accounts | Legal obligation (Article 6(1)(c)) and legitimate interests |
| To improve our services from your answers to our follow-up questions and your reports of mistakes | Legitimate interests |
| To keep the site and the services secure and stop abuse | Legitimate interests |
| To make or defend a legal claim | Legitimate interests |
The articles are those of the UK GDPR and the EU GDPR. Serbia's Law on Personal Data Protection (ZZPL) gives the same bases in Article 12.
4. Who else sees it
- Creem (Armitage Labs OÜ, Tallinn, Estonia) takes payments as our merchant of record. It is an independent controller of your payment data, under its own privacy policy.
- Our processors, who act only on our instructions: Hetzner (our server, in Finland), Cloudflare (the network in front of our site, its page load measurement, and file storage), Zoho (our mailbox, in the EU) and Google (the Gemini model, which also helps us draft answers to emails).
- TypeSafe (typesafe.ai), which checks the tone of emails we write and so may see your first name in them.
- Authorities, only where the law requires it.
We never sell your data.
5. Where your data goes
We are in Serbia. Our server is in Finland and our mailbox in Zoho's EU data centre. Cloudflare and Google are in the United States and are certified under the EU-US Data Privacy Framework and its UK Extension, and Google may process data briefly in any country where it operates. Serbian law allows transfers to EU countries and the UK, and for Cloudflare and Google we rely on the EU's recognition of the Data Privacy Framework. Creem is in Estonia.
6. How long we keep it
- Order records and our emails with you: while you are a customer, and after that for as long as we need them to answer questions or claims about an order and to meet our legal duties on records.
- Technical data: IP addresses only in memory, for at most a day. Error reports: only as long as we need them to fix the error. Visit statistics: 13 months, then deleted.
- The files you send us: see Deletion and return in the data processing agreement.
7. Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict our use of it, or to receive it in a portable form. You can object at any time to our use of it based on legitimate interests, and always to any use for marketing. Write to [email protected]. We answer within one month.
You can complain to a data protection regulator: in the UK, the Information Commission (ico.org.uk); in the EU, the authority in your country; in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs). We would like the chance to put things right first: we acknowledge every complaint within 30 days and answer it as fast as we can.
8. Automated decisions
We make no decision about you by automated means that has a legal or similarly significant effect on you.
10. Changes to this notice
We update this notice when what we do changes, and change the date at the top.
Questions about this page? Write to [email protected].