Privacy notice for people we contact

1. Your right to object

You can object at any time to our use of your details for marketing. Reply "no" to any of our emails, use the unsubscribe link in it, or write to [email protected]. We stop at once and never contact you again. You do not need to give a reason, and it costs nothing.

2. Who we are

We are Pavel Valynets PR Beograd, trading as Resume Banger (Resume Banger Hiring), a business registered in Serbia, with our seat at Jurija Gagarina 231, 11073 Beograd. Contact: [email protected]. Our full details are on the company details page. We are the controller of your data.

We have not appointed a data protection officer, because the law does not require one for what we do, and, for the people this notice covers, we have no representative in the UK or the EU.

3. Where we found your details

Only in places where they were published, mostly by your business itself:

• Job posts on LinkedIn and on the job boards of applicant tracking systems (for Shortlist): the role, where it is, and how many applicants the post shows.
• Your company's website, where your business email address is published. We record the page we found it on, and name that site in our first email.
• Public WARN notices, which employers file with US state agencies before layoffs (for the Outplacement pack): the site and the number of people affected.
• Public lists and websites of recruitment agencies (for the Submission pack).
• LinkedIn: your name, job title and profile address.

We never guess or build an email address: we use only one that is written on a public page.

4. What we keep

• your name, job title, company and business email address, and the page where we found the address;
• your LinkedIn profile address, if we found it;
• the facts from the job post or notice that we wrote about, and the time zone of your location, so that we write during your working hours;
• our messages to you, your replies, and a short label for each reply, for example "asked a question" or "not now";
• if you open the page we made for your business, when you first opened it and how many times.

5. Why, and our legal basis

We use your details to offer your business our services, to answer you, and to make sure we stop when you object.

Our legal basis is our legitimate interest in offering business services to people whose work includes hiring (Article 6(1)(f) of the UK GDPR and the EU GDPR, and Article 12(1)(6) of Serbia's Law on Personal Data Protection). We weighed that interest against yours: we use business contact details that were published, write about your own job post or notice, send one email and at most one follow-up, say where we found your address, and stop at once when you object. We have written this assessment down: write to [email protected] and we send it to you.

6. How we write to you, and the AI we use

We send one first email and, if you do not answer, at most one follow-up. We may also send you a connection request with a short note, or a message, on LinkedIn. If you reply, we answer, and if you want the service, we send you your private link.

Google's Gemini model drafts our messages from the facts above and sorts replies, so that an objection is honoured at once and a question gets an answer. TypeSafe checks that our messages read naturally and, while we test it, also sorts replies, after email addresses, links and phone numbers have been removed from them. These labels only decide what we do next with your reply. We make no decision about you by automated means that has a legal or similarly significant effect on you.

7. Your public LinkedIn posts, and messages you send us on LinkedIn

If you wrote a public LinkedIn post about hiring or recruiting, we may Like it from our company profile, and we send nothing with the Like. We keep the link to the post, your name and headline and a short excerpt of the post for 30 days, and a one-way fingerprint of your profile for 12 months, so that we never Like the same post twice or more than one post a day of yours. A post that is not clearly in English is also read by Google's Gemini model, to check that it is not about politics or another sensitive topic. Our legal basis is our legitimate interest in being seen by people in the trade (Article 6(1)(f)), and you can object to it at any time (see your rights below).

If you write to us on LinkedIn first, we keep your name, the line of your message that the conversation list shows, a label and, if you asked about a service, a drafted answer, for 12 months. Google's Gemini model writes the label and the draft, and a person at our business reads the draft before anything is sent. Our legal basis is the steps you ask for before a contract (Article 6(1)(b)) or, where that does not fit, our legitimate interest in answering the people who write to us (Article 6(1)(f)).

8. Who else sees your details

• Zoho (Zoho Mail, EU data centre): our mailbox.
• Hetzner (Finland): our server and database.
• Cloudflare (United States): the network in front of our site, and the measurement of page loads on it (Cloudflare Web Analytics, without cookies).
• Google (United States): the Gemini model that drafts our messages and sorts replies.
• TypeSafe (typesafe.ai): checks the tone of our messages, and sorts replies while we test it.
• LinkedIn, if we write to you there, under its own privacy policy.

They act on our instructions, except LinkedIn, which is responsible for its own service. We never sell your details.

9. Where your data goes

We are in Serbia. Our server is in Finland and our mailbox in Zoho's EU data centre. Cloudflare and Google are in the United States and are certified under the EU-US Data Privacy Framework and its UK Extension, and Google may process data briefly in any country where it operates. Serbian law allows transfers to EU countries and the UK, and for Cloudflare and Google we rely on the EU's recognition of the Data Privacy Framework.

10. How long we keep it

• If you never answer, we delete your details 12 months after our last message.
• If you never objected, then once your details are deleted we keep only a one-way fingerprint of your email address and of your LinkedIn profile address, which cannot be turned back into them, so that we never write to you again.
• If you answer, we keep our conversation for up to 12 months after the last message, unless you become a customer; then our privacy notice for customers applies.
• If you object or unsubscribe, we delete the rest but keep your email address, your LinkedIn profile address, the date and the reason on our do-not-contact list, so that we never contact you again. We keep that list for as long as we contact people about our services.

11. Your other rights

You can ask for a copy of your details, to correct them, to delete them, to restrict our use of them, or to receive them in a portable form. Write to [email protected]. We answer within one month.

You can complain to a data protection regulator: in the UK, the Information Commission (ico.org.uk); in the EU, the authority in your country; in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs). We would like the chance to put things right first: we acknowledge every complaint within 30 days and answer it as fast as we can.

12. Changes to this notice

We update this notice when what we do changes, and change the date at the top.