Privacy policy

1. Data controller

Leira is a recruitment service operated by BTY Gruppen AS, registered in Norway. BTY Gruppen AS is the data controller for the personal data we collect through this website and our recruitment services.

Privacy contact: personvern@lei-ra.com. We respond to privacy requests within one month.

2. What we collect

Candidate data

Name, phone, email, a short self-recorded intro video, and the traits you self-report in the application form. We store whether you are over 18 as a yes/no, never a date of birth.

Application & status data

The role you applied to, where you are in the process, and notes the recruiter writes.

Client contacts

Name, email, and role of people at employers using Leira.

Usage data

Basic, consent-based website analytics (page views). No tracking is set unless you have consented.

3. Purposes and legal basis

Processing your application to a specific role

Necessary to take steps prior to a possible employment contract. Legal basis: GDPR Art. 6(1)(b). We do not ask for consent for this, and you do not need talent-pool consent to apply.

Keeping you in the talent pool and sharing your profile with other employers

Only if you actively opt in. Legal basis: GDPR Art. 6(1)(a) (consent). You may withdraw at any time.

Providing the platform to employers

Legal basis: GDPR Art. 6(1)(b) (contract).

Website analytics

Only with your consent, per ekomloven § 2-7b. Legal basis: GDPR Art. 6(1)(a). You can change your choice at any time.

4. No automated decision-making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you (GDPR Art. 22). We do not use artificial intelligence to evaluate, rank, or filter candidates. Every assessment is made by a human at Leira.

We also run no facial or emotion recognition on your intro video. A recruiter watches it.

5. Recipients

When you consent to the talent pool, we share your profile with employers using Leira. That employer then acts as an independent data controller for its use of the data.

We use the following processors to run the service, all under a data-processing agreement: Supabase (database and storage, EU), Vercel (hosting, EU), Resend (email), a European SMS provider (notifications), n8n (workflow), Slack (internal notifications; only a candidate ID and link, never raw personal data), and Anthropic (only pseudonymized data for an optional search tool — never names, contact details, or assessments).

6. Transfers outside the EEA

We aim to keep personal data within the EEA. Some processors (Anthropic, Meta, Slack) are established in the US. Transfers there rely on the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework. Only pseudonymized data is sent to Anthropic; only an ID and link to Slack. You may request a copy of the safeguards by contacting us.

7. Retention

Unsuccessful applications are deleted after six months. Talent-pool profiles are kept for twelve months from consent, after which we ask for renewal or delete. Statutory audit and accountability logs are kept for at least six months in pseudonymized form. You can request deletion at any time.

8. Your rights

You have the right to access, rectification, erasure, restriction, data portability, and to object to the processing. Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal and with no detriment to an ongoing application.

You can withdraw talent-pool consent directly by replying STOP to an SMS from us or via your status page. For other rights, contact personvern@lei-ra.com. We respond within one month.

9. Security

Personal data is protected with row-level access control, encryption, and an immutable access log so we can trace who viewed or shared a candidate. We collect the minimum and share the minimum.

10. Complaints to the Norwegian DPA

For any questions, contact personvern@lei-ra.com. If you are unhappy with our response, you may lodge a complaint with Datatilsynet (the Norwegian Data Protection Authority) at datatilsynet.no.