Privacy policy

1. Data controller

Leira is a recruitment service operated by BTY Gruppen AS, registered in Norway. BTY Gruppen AS is the data controller for the personal data we collect through this website and our recruitment services.

Privacy contact: personvern@lei-ra.com. We respond to privacy requests within one month.

2. What we collect

Candidate data

Name, phone, email, a short self-recorded intro video, and the traits you self-report in the application form. We store whether you are over 18 as a yes/no.

Date of birth, only if you are under 18

If you tell us you are under 18 we ask for your date of birth. It is used for one thing: to know when you turn 18, so your profile can be shared with employers from that day and not before. It never forms part of any assessment of you, and it is deleted with the rest of your data. If you are over 18 we do not ask for it and do not store it.

Application & status data

The role you applied to, where you are in the process, and notes the recruiter writes.

Client contacts

Name, email, and role of people at employers using Leira.

Usage data

Basic, consent-based website analytics (page views). No tracking is set unless you have consented.

3. Purposes and legal basis

Processing your application to a specific role

Necessary to take steps prior to a possible employment contract. Legal basis: GDPR Art. 6(1)(b). We do not ask for consent for this, and you do not need talent-pool consent to apply.

Keeping you in the talent pool and sharing your profile with other employers

Only if you actively opt in. Legal basis: GDPR Art. 6(1)(a) (consent). You may withdraw at any time.

Providing the platform to employers

Legal basis: GDPR Art. 6(1)(b) (contract).

Website analytics

Only with your consent, per ekomloven § 2-7b. Legal basis: GDPR Art. 6(1)(a). You can change your choice at any time.

4. Human decisions, AI as a tool

No decision that significantly affects you is made by a machine alone (GDPR Art. 22). A person at Leira reviews and decides every screening outcome, and no one is rejected automatically. We use AI as an assistant, to transcribe and summarise screening calls, draft messages, and organise and search candidates, never as the decision itself.

Being specific about the screening call, because it is the place a model comes closest to judging you. If you agreed to the call being recorded, it is transcribed and we ask a model to propose a score from 1 to 5 on each of fifteen work traits, together with the sentence from the call it drew each score from. It is told to propose nothing where the call gives it no evidence. A recruiter reads those proposals, changes what they disagree with, and saves their own scores, which are what an employer sees. Your name and contact details are removed before any of it is sent.

You can ask what the model proposed about you. We keep a record of the model used and the scores it suggested at the time, so we can tell you, and you can tell us you think it got you wrong. Write to personvern@lei-ra.com and we will answer within one month.

We also run no facial or emotion recognition on your intro video. A recruiter watches it.

5. Recipients

When you consent to the talent pool, we share your profile with employers using Leira. That employer then acts as an independent data controller for its use of the data.

We use the following processors to run the service, all under a data-processing agreement: Supabase (database and storage, EU), Vercel (hosting, EU), Resend (email), a European SMS provider (notifications), n8n (workflow), Slack (internal notifications; only a candidate ID and link, never raw personal data), Google (Gemini, used to analyse advertising creative, and to read what you upload into your own profile draft, such as a photo or a link, so you do not have to type it all in yourself), and Anthropic (Claude, on pseudonymized data only, never names or contact details, used to transcribe and summarise, draft text, and suggest assessment inputs a human recruiter then reviews and decides).

To measure and improve our recruitment advertising, we share a limited set of hashed identifiers (for example a hashed email or phone number) with Meta through its Conversions API, so ad campaigns can be attributed to real hiring outcomes. The data is hashed before it leaves us and is processed under Meta’s data-processing terms. Legal basis: our legitimate interest in running effective recruitment advertising (GDPR Art. 6(1)(f)). You can object at any time by contacting us.

6. Transfers outside the EEA

We aim to keep personal data within the EEA. Some processors (Anthropic, Google, Meta, Slack) are established in the US. Transfers there rely on the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework. Only pseudonymized data is sent to Anthropic; only an ID and link to Slack. You may request a copy of the safeguards by contacting us.

7. Retention

Unsuccessful applications are deleted after six months. Talent-pool profiles are kept for twelve months from consent, after which we ask for renewal or delete. Statutory audit and accountability logs are kept for at least six months in pseudonymized form. You can request deletion at any time.

8. Your rights

You have the right to access, rectification, erasure, restriction, data portability, and to object to the processing. Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal and with no detriment to an ongoing application.

You can withdraw talent-pool consent directly by replying STOP to an SMS from us or via your status page. For other rights, contact personvern@lei-ra.com. We respond within one month.

9. Security

Personal data is protected with row-level access control, encryption, and an immutable access log so we can trace who viewed or shared a candidate. We collect the minimum and share the minimum.

10. Complaints to the Norwegian DPA

For any questions, contact personvern@lei-ra.com. If you are unhappy with our response, you may lodge a complaint with Datatilsynet (the Norwegian Data Protection Authority) at datatilsynet.no.