Privacy policy.

Last updated: 18 October 2026

Leie Folk AS recruits IT specialists for permanent positions in companies.

This policy is based on the Norwegian Personal Data Act (personopplysningsloven; Act of 15 June 2018 No. 38), which makes the EU General Data Protection Regulation (GDPR) applicable as Norwegian law.

Data controller

Leie Folk AS is the data controller for the personal data described in this policy.

• Leie Folk AS
• Org. no. 938 033 978
• Onshuusveien 17, 3045 Drammen
• post@leiefolk.no

We have not appointed a data protection officer. You can send any questions about privacy to post@leiefolk.no.

What this policy covers

This policy covers the personal data we process in the following services:

• The website. Leie Folk's public website, with information about our services.
• The candidate portal. This is where IT specialists create a profile and keep it up to date.
• The recruitment tool. An internal tool used only by Leie Folk's recruiters.
• The forms on the website. The “Start recruiting” form, where companies send us an enquiry, and the contact form for companies and job seekers.

What data we process

When you register as a candidate

To create a profile, you provide:

• first name and surname
• e-mail address and phone number
• place of residence
• a password
• consent to our processing of your data, with the time you gave it

Your password is not stored in plain text. Our sign-in provider stores it as a hash, a one-way transformation that means Leie Folk can never read your password.

When you build your profile in the candidate portal

In the candidate portal, you can choose to add more information:

• Role and experience. Current and desired job title, seniority, years of experience, a summary and industry experience.
• Availability. Whether you are available, from what date, and how long your notice period is.
• Job preferences. The type of employment you want, whether you want to work on site, hybrid or remotely, and whether you can travel for work.
• Security clearance. Whether you hold security clearance, at what level, and whether you are eligible for clearance.
• Profile photo. A photo of you, if you choose to upload one. It is kept in private file storage, and only you and our recruiters can see it.
• Links. LinkedIn, GitHub and portfolio.
• Expertise. Skills with level, number of years and when you last used them, certifications, and languages with proficiency level.
• Documents. CV, certificates, references and portfolio. The files are kept in private file storage, and only you and our recruiters can open them.
• Applications. Positions you have applied for, and the status of each application.

Data added by our recruiters

When our recruiters work with your profile, they also record:

• your status in the recruitment process
• keywords (tags)
• internal notes
• shortlists you are on
• which recruiter is responsible for you
• where the profile came from (source)

You also have the right of access to this data.

When a company sends us an enquiry

When a company uses the “Start recruiting” form, we process:

• the company's name and, if provided, its organisation number
• the contact person's name, work e-mail and phone number
• the role the company is looking to fill, seniority and technologies
• place of work and preferred start date
• the description of the requirement

When an employer uses the contact form, we store the name, e-mail address, phone number, company and message in the same way.

Our recruiters also record who is responsible for the company, how far the collaboration has come, and notes from calls and meetings.

When you contact us as a job seeker

If you use the contact form as a job seeker, we store your name, e-mail address, any phone number and LinkedIn profile, and your message. Only the recruiters at Leie Folk can read the enquiry, and we use the information only to reply to you.

If we reply to you by e-mail, we process that e-mail with our e-mail provider, in the same way as any other e-mail.

When you visit the website

The providers that host the website and deliver files to it receive your IP address and may record it in technical logs. You will find them under Service providers we use.

What we use the data for

We use personal data to:

• match candidates with positions
• contact candidates about relevant opportunities
• present a candidate profile to a client, once the candidate has agreed to this
• follow up on enquiries from companies
• manage client relationships
• issue invoices
• operate the website and the candidate portal securely

Legal basis

We process personal data only when we have a legal basis for doing so under Article 6 of the GDPR.

• Consent (Article 6(1)(a)). Your candidate profile is based on your consent.
• Contract (Article 6(1)(b)). When you apply for a position or are placed in a position, we process the data in order to enter into or perform a contract. This also covers steps you ask us to take before a contract is entered into.
• Legitimate interest (Article 6(1)(f)). We process data about contact persons at companies, data in enquiries and recruiters' internal notes because we have a legitimate interest in following up clients and running our recruitment properly. The same applies to the technical logs needed to operate and secure the services.
• Legal obligation (Article 6(1)(c)). We are required to retain accounting records, such as invoices, under the Norwegian Bookkeeping Act (bokføringsloven).

You can withdraw any consent at any time, as easily as you gave it. You do this in the candidate portal under “Privacy & settings” or by writing to post@leiefolk.no.

Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal.

Who we share data with

We present your profile to a client company only once we have discussed the specific opportunity with you and you have said yes.

The company first sees an anonymous profile: role, seniority and experience, skills, certifications, languages, availability, place of residence, industries you have experience from, and your preferred type of employment and way of working, without your name, photo and contact details. Once an interview is arranged, the company is also told the time and place, and whether you have confirmed it. We only share your name and contact details when the company wants to meet you and you have agreed.

Client companies cannot browse or search our candidate database.

We never sell personal data.

The providers that operate our services have access to data only to the extent they need it for their task. They are described in the next section.

We may disclose data where required by law.

Service providers we use

We use a small number of providers to operate the website and the candidate portal. Providers that process personal data on our behalf act as our data processors.

The database, sign-in and file storage at Supabase are located in the EU, in the AWS region eu-west-1 in Ireland.

Vercel is a US company with a global network. The transfer of data to Vercel is based on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

Supabase is also an American company. Although the data is stored in the EU, the company may access it, for example for support and operations. Such access is based on the data processing agreement with Supabase and the European Commission's Standard Contractual Clauses.

Where data is processed outside the EU/EEA, the transfer must have a valid basis under Chapter V of the GDPR.

Storage on your device

Section 3-15 of the Norwegian Electronic Communications Act (ekomloven) governs the storage of, and access to, information on your device, such as cookies.

We use no cookies for analytics or marketing, and we do not track you.

The website uses only your browser's local storage, and only for two things:

• Sign-in. We keep you signed in to the candidate portal. This only happens when you sign in.
• Language choice. We remember which language you have chosen.

Both are strictly necessary to provide services you have requested. We therefore do not need your consent, and the website does not show a consent banner.

How long we keep the data

• Candidate profile. We keep your profile for as long as your account is active and your consent remains valid.
• Profiles that have not been updated. If you have not updated your profile for 24 months, we will ask whether you want to keep it. If you do not reply, we will delete it.
• Enquiries from companies. We keep them for as long as we need them to follow up on the enquiry and the client relationship. They are deleted no later than three years after the last contact.
• Enquiries through the contact form. We keep them as long as we need them to reply and follow up. They are deleted no later than three years after the last contact.
• Accounting records. We retain them for five years, as required by section 13 of the Bookkeeping Act.
• Technical logs. Logs held by the providers that host the website are deleted after the providers' standard, short retention period.

You can delete your profile yourself at any time in the candidate portal under “Privacy & settings”. You can also request deletion by writing to post@leiefolk.no.

If you withdraw your consent, we will delete your data without undue delay and within 30 days at the latest.

Your rights

Under the GDPR, you have the following rights:

• Access (Article 15). You can find out what data we hold about you and obtain a copy of it.
• Rectification (Article 16). You can have inaccurate or incomplete data corrected.
• Erasure (Article 17). You can ask us to erase the data we hold about you.
• Restriction (Article 18). In certain cases, you can ask us to restrict the processing of your data.
• Data portability (Article 20). You can receive the data you have provided to us in a machine-readable format. You can download it yourself in the candidate portal.
• Objection (Article 21). You can object to processing based on legitimate interest.
• Withdrawal of consent (Article 7(3)). You can withdraw any consent you have given at any time.

You can do most of this yourself in the candidate portal. There you can view and correct your profile, download your data and delete your account.

For anything you cannot find in the portal, write to post@leiefolk.no. We will respond within one month.

No automated decision-making

We do not make any decisions about you based solely on automated processing. Nor do we use profiling that produces legal effects concerning you or similarly significantly affects you (Article 22).

All assessments are made by our recruiters. Search and filters in the recruitment tool are aids for people, not a means of making automated decisions.

How we protect the data

• The connection between your browser and our services is encrypted (HTTPS).
• Access control in the database ensures that each candidate sees only their own data.
• Only authorised recruiters have access to the candidate database.
• The documents you upload are kept in private file storage.
• Only Leie Folk employees who need the data for their work have access to it.

Complaints to the Norwegian Data Protection Authority

If you believe we are processing your personal data in breach of the rules, you can lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

We would appreciate it if you contacted us first, so that we can try to resolve the matter.

• Datatilsynet
• Postboks 458 Sentrum, 0105 Oslo
• www.datatilsynet.no

Changes to this policy

We update this policy when our services or the rules change. The date at the top shows when it was last changed.

We announce significant changes on the website. If you are registered as a candidate, you will also be notified by e-mail.