Version of October 1, 2026
1. Ondemand Apps OÜ, registration number 14521027, Tornimäe 7-36, 10145 Tallinn, Estonia (“Onde”, “we”, “us”), is the controller of the personal data described in this Policy. You can contact us at hi@onde.app or at our postal address.
2. This Policy covers people who apply to, or are considered for, work with us as employees, freelancers, sole proprietors or under another services contract, and the referees who give us information about them.
3. It does not cover data we process after you are hired or engaged, which is covered by a separate notice that you receive at that point. When you use our website, including the careers page, our Website Privacy Policy covers cookies and technical data.
1. From you: your name and email address, your CV and the information in it, your message to us, notes from interviews, the results of any test task, our evaluation and the status of your application.
2. From others: information you have made public in professional profiles (such as LinkedIn, GitHub or a portfolio site), to the extent relevant to the role, and references from referees you name or who recommend you. We contact referees only with your knowledge.
3. Please do not send us information about your health, beliefs, ethnic origin or other special categories of data, or about criminal convictions. We do not ask for or check criminal records. If you ask us to adjust the selection process, for example because of a disability, we use that information only for the adjustment and delete it together with your application.
4. Your name, email address and CV are needed to consider your application. Without them, we cannot do so. Everything else is optional.
| Purpose | Legal basis (GDPR) |
|---|---|
| Assessing your application and communicating with you | Our legitimate interest in selecting suitable people for our team (Art. 6(1)(f)) |
| Preparing an offer or a contract at your request | Steps you request before entering into a contract (Art. 6(1)(b)) |
| Considering you for other roles, only if you tick the talent-pool box | Consent (Art. 6(1)(a)) |
| Meeting our legal obligations, such as equal-treatment rules | Legal obligation (Art. 6(1)(c)) |
| Establishing, exercising or defending legal claims | Our legitimate interest in protecting our rights (Art. 6(1)(f)) |
| Checking a reference you give about a candidate (if you are a referee) | Our legitimate interest in assessing the candidate (Art. 6(1)(f)) |
Where we rely on legitimate interests, you can ask us at hi@onde.app how we balanced them against your rights.
1. Right to object. Where we rely on our legitimate interests, you may object at any time, on grounds relating to your particular situation, by writing to hi@onde.app. We will then stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims.
1. Within Onde, only the people involved in the hiring process see your data, on a need-to-know basis.
2. Service providers that act on our instructions: TalentLyft (AdoptoTech d.o.o., Croatia); our applicant tracking system; our email, messaging, and document tools; and the e-signature, error-monitoring, and anti-bot services used on our forms.
3. If the role is with a company related to Onde, we pass your application to that company. From that point it decides on hiring or engagement as a separate controller. If you choose to be engaged through an organization such as a business incubator, we share with it the data needed for that engagement.
4. Legal advisers, courts and competent authorities, where the law requires it or where it is necessary to establish, exercise or defend legal claims.
5. Some recipients are located outside the European Economic Area (“EEA”) in countries where companies related to Onde are located. For recipients in the United States certified under the EU-U.S. Data Privacy Framework we rely on Commission Implementing Decision (EU) 2023/1795. For other transfers we use the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, with supplementary measures where required.
1. We keep your data only for the periods in the table below. After that we delete it or irreversibly anonymize it.
| Situation | Retention period |
|---|---|
| Your application is not successful | 12 months after we tell you our decision, or after the role is filled if we could not reach you |
| You tick the talent-pool box | 24 months from your consent, unless you withdraw it earlier |
| You are hired or engaged | Your data moves to your personnel or contract file, which is covered by a separate notice |
| A claim is made | Until the claim is finally resolved |
| You are a referee | Together with the file of the candidate you gave a reference for |
| Copies in email and back-ups | Deleted within 30 days after the periods above end |
1. Subject to the conditions of the GDPR, you may request access to your data and a copy of it, rectification, erasure, restriction of processing and, where processing is based on consent or contract and carried out by automated means, data portability. You may withdraw your talent-pool consent at any time by writing to hi@onde.app, without affecting the lawfulness of earlier processing.
2. To exercise your rights, write to hi@onde.app. If we have reasonable doubts about your identity, we may ask for the information necessary to confirm it.
3. You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, info@aki.ee, or with the supervisory authority of the EEA country where you habitually reside or work or where the alleged infringement took place.
1. We do not make hiring or engagement decisions based solely on automated processing.
2. We may update this Policy. The current version and its date are published on our website.