Privacy policy

1. Overview

To help make this Policy easier to follow, here are the key points:

• We collect personal data such as contact details, professional profile information, platform activity, communication data, and certain AI interaction data.
• We use this data to operate the Nordly platform, match talent with relevant opportunities, improve the user experience, maintain security, communicate with users, and comply with legal obligations.
• We may share certain personal data with potential employers, service providers, and professional advisers where necessary and subject to safeguards.
• We may use anonymised and aggregated data to analyse usage patterns, improve the platform, and create internal insights or market reporting.
• We do not sell personal data.
• We apply technical and organisational security measures to protect personal data.
• You have rights under data protection law, including rights of access, rectification, erasure, restriction, portability, and objection.

If you have any questions about this Policy, please contact us using the details in section 13.

2. Who we are

Legal entity

Nordly is operated by Nordic Valley ApS, a company registered in Denmark.

Registered address: Lange-Mullers Gade, 2100 Copenhagen, Denmark
CVR number: 45653471

Where this Policy refers to Nordly, we, us, or our, this means Nordic Valley ApS.

Data controller

Nordly is the data controller for the personal data collected through the Website and Platform, unless otherwise stated.

This means we determine how and why personal data is processed.

3. What data we collect

We collect personal data at different stages of the user journey. Depending on how you use Nordly, this may include:

Contact information

When you create an account or contact us, we may collect:

• first and last name
• email address
• phone number
• company name and role title (where relevant)

Professional and profile information

To support matching and hiring workflows, we may collect:

• CV or résumé
• LinkedIn profile or other professional profile information
• work history, education, skills, certifications, languages, and experience
• salary expectations, availability, location preferences, and role preferences
• portfolio links, profile descriptions, and application responses

AI interaction data

If you interact with Nordly through AI-powered flows, questionnaires, chat features, or voice-based interactions, we may collect:

• your inputs and responses
• transcripts of text or voice interactions
• profile summaries and inferred fit insights generated by the platform

Unless explicitly stated otherwise, voice recordings and transcripts are used to support platform functionality, quality assurance, and improvement of our services, and are not automatically shared with employers.

User-generated content

This includes files, documents, notes, messages, forms, and other materials you upload or submit through the Platform.

Usage, device, and technical data

When you access the Website or Platform, we may collect:

• IP address
• browser type and device information
• operating system
• log-in activity
• cookie identifiers
• page interactions and feature usage
• security and authentication records

Marketing preferences

We may record your communication and marketing preferences, including whether you wish to receive updates, product news, or role alerts.

Public professional information

We may collect publicly available professional data from sources such as LinkedIn, company websites, public directories, or other professional networking sources, where lawful and relevant to our services. We use this data to support talent discovery, candidate sourcing, and matching functions.

4. How we use your data

We use personal data only where necessary and proportionate for the purposes described below.

Account setup and administration

We use personal data to:

• create and manage user accounts
• authenticate access
• provide platform features
• communicate with users about their account or activity

Talent matching and hiring services

We use personal data to:

• build and maintain candidate profiles
• generate relevant role or candidate matches
• support introductions between job seekers and employers
• improve the relevance of platform recommendations
• support hiring workflows and internal platform decision support

AI processing and improvement

We may use AI systems to:

• interpret and structure profile information
• generate fit scores, rankings, summaries, and suggestions
• support explainability and matching quality
• improve the performance of our matching and hiring infrastructure

We may also use anonymised or aggregated data, including anonymised transcripts and platform usage patterns, to improve our models and services.

‍

We do not use your personal data to create biometric voiceprints, and we do not sell or license your personal data to train third-party AI models.

Communication

We use personal data to:

• notify you about roles, candidate activity, or platform updates
• respond to support or legal requests
• send marketing or product communications, where permitted

You can opt out of marketing communications at any time.

Platform security and integrity

We use personal data to:

• detect fraud, abuse, and unauthorised access
• investigate misuse of the Platform
• maintain system security and reliability

Compliance and legal obligations

We may process personal data where necessary to:

• comply with legal, regulatory, accounting, and audit obligations
• respond to lawful requests from authorities
• establish, exercise, or defend legal claims

5. Legal basis for processing

Under the GDPR, we must have a lawful basis for processing personal data. Depending on the context, we rely on one or more of the following:

Performance of a contract

We process personal data where necessary to provide the Platform and fulfil our obligations to users under applicable terms.

Legitimate interests

We process personal data where necessary for our legitimate interests, including:

• operating and improving the Platform
• matching candidates and employers
• maintaining security
• supporting hiring infrastructure and internal platform operations

Where we rely on legitimate interests, we consider and balance your rights and interests.

Consent

In some cases, we rely on your consent, for example where:

• you choose to make your profile public or visible to employers
• you opt in to marketing communications
• you provide special category data and authorise specific use

You can withdraw consent at any time, but this will not affect lawful processing carried out before withdrawal.

Legal obligations

We may process personal data where necessary to comply with legal or regulatory requirements.

Special category data

Special category data includes information such as health data, religious beliefs, sexual orientation, political opinions, racial or ethnic origin, or trade union membership.

‍

We do not intentionally collect such data as part of normal platform use. If you choose to provide such information, we will only process it where a lawful basis exists, which may include your explicit consent where required.

‍

We encourage users to avoid sharing unnecessary sensitive information.

6. How our AI works and your control

Nordly uses AI-assisted systems to support matching, screening, profile interpretation, and related hiring workflows.

Automated processing

Our systems may generate:

• fit scores
• rankings
• summaries
• suggestions
• candidate or role insights

These outputs are used as decision-support tools, not as fully autonomous decision-makers.

Human review

Hiring decisions are made by employers and human users. Nordly does not require employers to rely solely on automated outputs, and our platform is intended to support human decision-making.

Transparency

If you want more information about how Nordly’s AI tools affect your profile or platform experience, you may contact us at info.nordly.org@gmail.com.

‍

Where required by law, you may also request human review of certain automated processing outcomes.

7. Data sharing and transfers

We may share personal data with the following categories of recipients:

Employers and hiring teams

Where relevant to the functioning of the Platform, and depending on your settings and activity, we may share candidate profile information with employers using Nordly for hiring. This may include profile details, CV data, professional information, application responses, and platform-generated summaries or fit insights.

Service providers

We use third-party service providers for hosting, cloud infrastructure, analytics, communications, AI processing, storage, customer support, and related operational needs. These providers may process personal data on our behalf under appropriate contractual safeguards.

Professional advisers

We may share personal data with lawyers, accountants, auditors, insurers, or other professional advisers where necessary.

Regulators and authorities

We may disclose personal data where required by law, regulation, legal process, or to protect our rights or those of others.

Business transfers

If Nordly or Nordic Valley undergoes a restructuring, merger, investment, acquisition, or sale, personal data may be transferred as part of that transaction, subject to applicable law.

No sale of personal data

We do not sell personal data to third parties.

International Transfers

Some of our service providers may process data outside the EEA. Where we transfer personal data internationally, we will ensure that appropriate safeguards are in place, such as:

• adequacy decisions
• Standard Contractual Clauses
• equivalent lawful transfer mechanisms

8. Data retention and security

Retention

We keep personal data only for as long as necessary for the purposes described in this Policy, unless a longer retention period is required by law or justified by a legitimate business need.

‍

We may retain data for purposes such as:

• account administration
• legal compliance
• fraud prevention
• dispute resolution
• audit and recordkeeping
• platform analysis and improvement

When personal data is no longer needed, we will delete it or anonymise it where feasible.

Deletion requests

You may request deletion of your account and personal data at any time by:

• using the relevant settings in your account (if available); or
• contacting us at legal@nordly.org

If we are unable to delete certain data immediately for legal, technical, or operational reasons, we will restrict its use and retain it only as necessary.

Security

We implement technical and organisational measures designed to protect personal data from:

• unauthorised access
• accidental loss
• misuse
• disclosure
• alteration
• destruction

These measures may include access controls, encryption, logging, authentication, vendor assessments, and internal governance controls.

No system is completely secure, but we regularly review and improve our safeguards.

9. Your rights

Under the GDPR and other applicable data protection laws, you may have the right to:

Access

Request a copy of the personal data we hold about you.

Rectification

Request correction of inaccurate or incomplete personal data.

Erasure

Request deletion of your personal data in certain circumstances.

Restriction

Request restriction of certain processing.

Objection

Object to processing based on legitimate interests, including direct marketing.

Data portability

Request that certain data be provided in a structured, commonly used, machine-readable format.

Withdraw consent

Withdraw consent where we rely on consent as the legal basis.

Lodge a complaint

You have the right to lodge a complaint with the relevant supervisory authority, including the Danish Data Protection Agency (Datatilsynet), if you believe your rights have been violated.

‍

To exercise your rights, contact us at: info.nordly.org@gmail.com

‍

We may need to verify your identity before responding. We will respond within the time required by applicable law.

Please note that some rights are not absolute and may be subject to legal limitations or exceptions.

10. International users

Nordly is operated from Denmark and intended for users in the EU, EEA, and other international markets.

‍

If you access the Platform from outside Denmark, you are responsible for ensuring that your use complies with local laws where applicable.

‍

Where personal data is transferred internationally, we will apply appropriate safeguards as described above.

11. Cookies and similar technologies

We may use cookies, analytics tools, and similar technologies to:

• operate the Website and Platform
• remember preferences
• analyse traffic and usage
• improve functionality
• support security and authentication

You may be able to manage cookie preferences through your browser or through our cookie settings tool, where available. Disabling certain cookies may affect functionality. View our full cookie policy here.

12. Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect:

• changes to our services
• changes to applicable law
• changes to our technology or processing practices

The latest version will always be posted on the Website. If we make material changes, we may notify users by email or through a prominent notice on the Platform. By continuing to use the Platform after such changes take effect, you acknowledge the updated Policy.