Privacy Statement
How we process personal data when you visit our site, contact us or use KRUT.
Current as of:
At a glance
It also explains the distinction between personal data that KRUT processes for its own purposes and personal data processed through the KRUT recruitment platform on behalf of our customers.
1Who is responsible for your personal data?
KRUT is currently operated as a project prior to the incorporation of a legal entity.
For processing where KRUT determines why and how personal data is used, responsibility currently rests with:
- Zacharias Holm
- Erika Augustsson
- Hampus Patronen
operating under the name KRUT.
For questions about privacy or the processing of personal data, please contact:
When a legal entity for KRUT is incorporated, responsibility for relevant processing may be transferred to that entity and this Privacy Statement will be updated accordingly.
2A note for candidates
If you apply for a job, submit an open application or otherwise provide personal data to an organisation that uses KRUT for recruitment, this Privacy Statement does not primarily govern that organisation's processing of your personal data.
The organisation you interact with normally determines the purposes and means of its recruitment process and therefore acts as the data controller for candidate data.
In those circumstances, KRUT generally processes personal data as a data processor on behalf of that organisation and according to its instructions.
For information about how your personal data is used in a specific recruitment process, including how long it is retained and the legal basis for the processing, please refer to the privacy information provided by the organisation you are applying to or contact that organisation directly.
If you contact KRUT regarding candidate data processed on behalf of one of our customers, we may refer your request to the relevant customer or assist that customer in handling your request.
3Personal data we process for our own purposes
The personal data we process depends on how you interact with KRUT.
Website visitors
When you visit krut.tech, we may process technical information generated through your use of the website, including:
- IP address
- browser type and version
- device type
- operating system
- pages requested
- date and time of requests
- referring website
- technical logs
- security and error information
We use information that is necessary to provide, maintain and protect the website based on our legitimate interest in operating a secure and reliable service.
Where analytics, advertising or other non-essential tracking technologies are used, they are subject to the rules described in the Cookies and similar technologies section below.
Demo requests, beta applications and enquiries
If you request a demo, express interest in participating in a beta programme, contact us or otherwise ask us for information about KRUT, we may process information such as:
- your name
- your work email address
- your telephone number, if provided
- your job title or role
- the organisation you represent
- company or team size
- information about your recruitment process
- information about how you are interested in using KRUT
- your preferred time or method of contact
- information you choose to provide about your needs or challenges
- other information included in your communication with us
We use this information to:
- respond to your request
- arrange and conduct demonstrations
- assess and administer beta participation
- understand your organisation's needs
- communicate with you about KRUT
- manage a potential business relationship
The legal basis is normally our legitimate interest in responding to enquiries, developing our product and establishing business relationships with organisations interested in KRUT.
Providing this information is voluntary. However, if you do not provide information that is necessary to handle your request, we may not be able to respond or provide the requested demonstration or beta access.
Business contacts and potential customers
We may process limited professional information about people who represent organisations that we reasonably believe may be interested in KRUT.
This may include:
- name
- professional role
- company
- professional contact information
- information about your professional responsibilities
- information relevant to a potential business relationship
This information may come directly from you, from the organisation you represent, from a referral or from publicly available professional sources such as company websites or professional networking platforms.
We may use this information to contact you about KRUT where we have a legitimate interest in doing so and where such contact is permitted under applicable law.
We aim to keep this processing proportionate and limited to professional contexts.
You may object to this processing or ask us not to contact you again at any time by contacting privacy@krut.tech.
Customer representatives and KRUT users
If you use KRUT on behalf of a customer or another organisation, we may process limited personal data relating to your use of the service, such as:
- name
- work email address
- organisation
- role and permissions
- account information
- authentication and security information
- activity and audit information
- communications with KRUT
- support requests
Some of this information may be processed on behalf of the organisation you represent.
KRUT may also process limited information for its own purposes where necessary to administer the customer relationship, provide support, maintain security, prevent misuse, develop the service and comply with legal obligations.
Where KRUT processes such information for its own purposes, the legal basis is normally our legitimate interest in providing, administering, securing and improving KRUT and managing our business relationship with the organisation you represent.
4Communications
If you communicate with us by email, through a form, in a meeting or through another communication channel, we may process your contact details and the content of that communication.
We use this information to respond to you, maintain relevant records and manage our relationship with you or the organisation you represent.
The legal basis is normally our legitimate interest in communicating with people who contact us and administering our business relationships.
If a meeting is recorded or transcribed, we will provide appropriate information before the recording or transcription begins where required.
5Marketing
We may communicate with existing and prospective business contacts about KRUT where permitted by applicable law.
Where this processing is based on our legitimate interests, those interests are to promote KRUT to organisations and professional contacts that may reasonably be interested in the service.
You have the right to object at any time to the use of your personal data for direct marketing.
If an email contains an unsubscribe function, you can also use that function to stop receiving similar communications.
Where applicable law requires consent for a particular form of marketing, we will obtain consent before carrying out that processing.
We may retain limited information about an objection or unsubscribe request in order to ensure that we respect that request in the future.
6How long we keep personal data
We do not keep personal data for longer than reasonably necessary for the purpose for which it is processed.
The applicable retention period depends on the context.
For prospective customers, demo requests, beta enquiries and other business contacts, we normally retain relevant information for up to two years after our most recent meaningful interaction with you.
Information relating to an active customer relationship may be retained for the duration of that relationship and afterwards where reasonably necessary for administration, legal obligations, dispute resolution or the establishment, exercise or defence of legal claims.
Account information relating to users of KRUT is generally retained while the relevant account or customer relationship is active and thereafter for as long as reasonably necessary for account administration, security, legal obligations or the resolution of disputes.
Technical, security and audit information is retained according to the purpose for which it was generated and for no longer than reasonably necessary to operate, secure, troubleshoot or protect the relevant systems.
Where legislation requires information to be retained for a specific period, we may retain it for that period.
Personal data processed by KRUT solely on behalf of a customer is retained or deleted according to the customer's instructions and the applicable agreement with that customer.
7Service providers
We use third-party service providers to help us develop, operate, secure and communicate through KRUT.
Depending on the processing involved, these providers may provide services relating to:
- website hosting
- cloud infrastructure
- databases and data storage
- authentication
- email delivery
- customer communication
- software development infrastructure
- security and error monitoring
- analytics
- customer relationship management
- collaboration and support
Where a provider processes personal data on our behalf, we take steps appropriate to the nature of the processing to ensure that the provider is subject to appropriate data protection obligations.
We do not sell personal data.
We may also disclose personal data where required by law, a competent authority or a court, or where reasonably necessary to establish, exercise or defend legal claims.
Information about relevant service providers can be requested by contacting privacy@krut.tech.
For customers whose personal data is processed through the KRUT service, information about relevant subprocessors may also be provided through the applicable contractual documentation or subprocessor information.
8International data transfers
We aim to use services and infrastructure that provide an appropriate level of protection for personal data.
Some providers or their subcontractors may nevertheless process personal data outside the European Economic Area.
Where a transfer of personal data outside the EEA is subject to the GDPR, we will only make or permit that transfer where a lawful transfer mechanism applies.
Depending on the circumstances, this may include:
- a European Commission adequacy decision
- participation in an applicable recognised adequacy framework
- the European Commission's Standard Contractual Clauses
- another transfer mechanism permitted by applicable data protection law
Where required, additional technical or organisational safeguards may also be used.
You can contact privacy@krut.tech for more information about transfers relevant to your personal data.
10Candidate data processed through KRUT
KRUT provides software that organisations can use to manage recruitment processes, applications and candidate information.
Depending on how a customer configures and uses KRUT, candidate information may include information such as:
- contact and identification information
- CVs and application documents
- application responses
- employment history
- education and qualifications
- notes and evaluations
- interview information
- communications relating to the recruitment process
- information provided by the candidate
- other information added by authorised users of the customer
The exact personal data processed is determined by the customer and its use of KRUT.
When KRUT processes this information solely on behalf of a customer, KRUT acts as a data processor and processes the information according to the customer's documented instructions and the applicable agreement.
The customer remains responsible for determining the purposes and legal basis for its recruitment processing and for providing candidates with appropriate information about that processing.
11Recruitment support and automated processing
KRUT may provide functionality designed to help recruitment teams organise, search, summarise, compare or evaluate information relating to candidates and recruitment processes.
Such functionality may include the presentation or prioritisation of information based on criteria configured or selected by the customer.
KRUT does not itself decide whether a candidate should be hired, rejected or otherwise progress in a recruitment process.
Recruitment decisions remain with the organisation using KRUT.
Whether a customer's particular configuration or use of KRUT constitutes profiling or automated decision-making under applicable data protection law depends on the relevant processing and how the customer uses the service.
Where applicable, the customer is responsible as data controller for ensuring that its use of such functionality has an appropriate legal basis and that candidates receive the information and protections required by law.
KRUT does not subject visitors to krut.tech, demo contacts or prospective customers to solely automated decisions that produce legal effects or similarly significantly affect them.
12Sensitive personal data
We do not ask website visitors, demo contacts or prospective customers to provide sensitive personal data unless there is a specific and lawful reason to do so.
Please avoid including sensitive personal information in free-text fields or general communications unless it is relevant and necessary.
Candidate data processed through KRUT may in some circumstances contain information subject to additional protection under applicable law. Where KRUT processes such information on behalf of a customer, the customer is responsible for determining whether the processing is permitted and KRUT processes the information according to the customer's instructions and the applicable agreement.
13Security
We take technical and organisational measures appropriate to the nature and risk of the processing to protect personal data against unauthorised access, disclosure, alteration, loss or destruction.
The measures used may vary depending on the type of information, the relevant system and the risks associated with the processing.
Access to personal data is limited to people and service providers who require access for an authorised purpose.
No technical system can be guaranteed to be completely secure, and this Privacy Statement should not be interpreted as such a guarantee.
14Your rights
Where KRUT is responsible for the processing of your personal data, you may have the right under applicable data protection law to:
- receive information about how your personal data is processed
- obtain confirmation as to whether we process personal data about you
- obtain access to your personal data
- request correction of inaccurate personal data
- request completion of incomplete personal data
- request deletion of personal data in certain circumstances
- request restriction of processing in certain circumstances
- object to processing based on legitimate interests
- object at any time to processing for direct marketing
- receive certain personal data in a structured, commonly used and machine-readable format where the right to data portability applies
- withdraw consent at any time where processing is based on consent
These rights are subject to the requirements and exceptions provided by applicable law and do not apply identically in every situation.
If processing is based on consent, withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal.
To exercise your rights in relation to processing for which KRUT is responsible, contact:
We may need to take reasonable steps to verify your identity before fulfilling a request.
If your request relates to candidate data that KRUT processes solely on behalf of one of our customers, the relevant customer is normally responsible for responding to the request. In such circumstances, we may refer you to the customer or assist the customer in handling the request.
15Complaints
If you believe that your personal data has been processed in breach of applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority.
In Sweden, the supervisory authority is:
- Integritetsskyddsmyndigheten (IMY)
Information is available at imy.se.
Depending on where you live or work, you may also have the right to lodge a complaint with another competent data protection authority within the EU or EEA.
You are welcome to contact us at privacy@krut.tech before making a complaint so that we have an opportunity to investigate your concern, but you are not required to do so.
16Changes to this Privacy Statement
KRUT is currently under development and the way our website and service operate may change over time.
We may update this Privacy Statement when:
- our services or functionality change
- we introduce or replace service providers
- the purposes for which we process personal data change
- KRUT is incorporated as a legal entity
- applicable legal requirements change
- we otherwise need to clarify how personal data is processed
The current version will be made available on krut.tech.
Where a change materially affects how we process personal data, we will take reasonable steps to provide additional notice where appropriate.
The date at the top of this Privacy Statement shows when it was most recently updated.
17Contact
For questions about this Privacy Statement, how KRUT processes personal data or how to exercise your rights, contact:
KRUT is currently operated by:
- Zacharias Holm
- Erika Augustsson
- Hampus Patronen
prior to the incorporation of a legal entity.