Candidate Privacy Policy

Effective date: 2026.10.19

This policy explains how Duna collects and uses your personal data when you apply for a role, are referred to us, or speak with us about working together.

Duna hires across Europe. Most of our roles are remote and not tied to a particular country. Where we employ people outside the Netherlands, we usually do so through an employer of record, as explained below.

1. Who is responsible for your data?

Duna B.V., Jacob van Lennepkade 27-2, 1054 ZE Amsterdam, the Netherlands (“Duna”, “we”, “us”), is responsible for the processing described in this policy.

For questions about your personal data, or to exercise your rights, contact recruiting-privacy@duna.com. This is the single contact point for everything in this policy.

2. What information do we collect?

We process information relevant to recruitment, including:

• Your name, contact details, CV, professional profile and portfolio.

• Your education, qualifications, professional experience and application answers.

• Your availability, role preferences, location and relevant work-authorisation information.

• Our communications with you, interview notes, assessments and hiring feedback.

• Interview transcripts and summaries, as explained below.

Most information comes directly from you when you submit your application through our careers page. We may also receive relevant professional information from recruitment agencies who put your profile forward, people who refer you, and public professional sources such as LinkedIn.

Where a recruitment agency introduces you to us, they are responsible for telling you how they handle your data and for informing you before they share your profile. Once we receive it, this policy applies.

Where we receive your information from another source, we explain where it came from and provide this notice within a reasonable period, no later than one month after obtaining it. If we communicate with you or disclose your information to another recipient sooner, we provide the notice no later than that first communication or disclosure, unless an applicable legal exception applies.

Please provide only information relevant to your application. We do not currently request identity documents, diversity information, or background and reference checks as part of this process. If you accept an offer, we will need identity and right-to-work documents before you start; we will explain that separately at the time.

If you need an adjustment for an interview, contact careers@duna.com. Where this involves health or disability information you choose to share, we rely on your explicit consent under Article 6(1)(a) and Article 9(2)(a) GDPR. If applicable employment law instead requires us to process particular information to arrange an adjustment, we will explain the relevant legal obligation and the applicable condition for processing health information before collecting it. We request only what is necessary to arrange the adjustment and restrict access to the people responsible for providing it.

3. How and why do we use your information?

We use your information to communicate with you, organise interviews, evaluate your suitability and, where appropriate, prepare an offer and employment contract.

• Steps towards a contract at your request: handling your application and preparing a potential employment contract where necessary for those steps.

• Legitimate interests: sourcing and contacting prospective candidates, supporting human assessment of applications including with AI-assisted review, taking and summarising interview notes, and organising recruitment. Our interests are finding suitable people and running an effective and fair process. We assess whether these interests are proportionate to the impact on you.

• Legal claims: retaining limited relevant information where necessary to establish, exercise or defend legal claims, on the basis of our legitimate interests.

• Legal obligations: responding to data protection rights requests and complying with binding legal requirements applicable to the information we hold.

• Consent: keeping your profile for future roles after a process ends, and any health or disability information you share for an interview adjustment.

Information marked as required in our application form is needed to consider your application. Without it, we may be unable to proceed.

4. Interview notes, transcription and AI assistance

AI-assisted review. We may use AI tools to support our hiring team during the recruitment process. Every provider we use is covered by a data processing agreement. These tools support human assessment by organising and summarising application information and suggesting points to explore in interviews. Our hiring team checks their outputs and makes all hiring decisions.

Notetaking and transcription. Our interviewers may use notetaking and transcription tools, including Granola, to produce a transcript and summary of your interview. This lets them focus on the conversation rather than on typing, and makes their notes more accurate.

To be clear about what these tools do and do not do: they record what was said and help our interviewers write up their notes. These notetaking and transcription tools do not independently evaluate or score you. Our interviewers check the transcripts and summaries before using them to support their own assessment and make the hiring decisions.

We will tell you when we invite you to interview whether transcription is planned. If you would prefer not to be transcribed, tell us before or at the start of the interview and we will take manual notes instead. This has no effect on your application. You can also ask the interviewer to stop at any point during the conversation, or contact your point of contact at Duna.

We keep the transcript and summary rather than an audio or video recording. Audio is processed to generate the transcript. Granola’s desktop application transcribes in real time without storing an audio recording; its mobile application may temporarily cache audio while transcription completes.

Our hiring team checks AI-generated material before using it, and people make the hiring decisions. You can contact recruiting-privacy@duna.com to raise an error or request access, correction or deletion, subject to the applicable legal conditions. Access is restricted to those involved in recruitment and the providers supporting the process.

Transcripts, summaries and AI-assisted review notes are covered by the retention periods below, including copies held in our recruitment system, in notetaking tools and in any exported working files.

5. Automated decisions

We do not make decisions about your application based solely on automated processing. People review applications and make hiring decisions.

6. Who receives your information?

Within Duna, your information is accessible to people involved in recruitment who need it for their role. We use:

• Ashby: application and recruitment management.

• Google Meet: video interviews.

• Granola and other notetaking tools: interview transcription and summaries.

• AI service providers: tools supporting the application review described above.

• Recruitment agencies and sourcing platforms: where they introduce candidates or support a search.

• Employers of record: if we offer you a role in a country where we do not have our own legal entity, we will employ you through an employer of record. At that point we share the information needed to prepare your employment with that provider, and we will tell you who they are.

These providers and their authorised service providers receive only the information necessary for their services. We may share specific information with professional advisers or authorities where necessary for legal advice, legal claims or compliance with an applicable obligation.

Contact recruiting-privacy@duna.com for information about the providers processing your data.

7. How we protect your information

We apply technical and organisational measures appropriate to the risk, including access controls that limit candidate information to the people involved in your recruitment, encryption in transit and at rest with our providers, and contractual data protection commitments with every provider listed above.

8. International transfers

Our service providers may process your information outside the European Economic Area and the United Kingdom, including in the United States.

For transfers requiring protection under applicable data protection law, we rely on an applicable adequacy decision or on contractual safeguards, including the European Commission’s Standard Contractual Clauses and, where UK law applies, the UK Addendum, with supplementary measures where needed.

Contact recruiting-privacy@duna.com for information about the safeguards applicable to your data and how to obtain a copy.

9. How long do we keep your information?

We keep your information only for as long as we need it for the purposes described in this policy. When that period ends, we delete it or remove the details that identify you.

If we do not offer you a role

We delete or anonymise your application within 4 weeks of the recruitment process ending.

If you ask us to keep your details for future roles

When you apply, you can tell us whether you would like us to keep your profile in case a more suitable role opens up. If you agree, we keep it for 12 months after the recruitment process ends.

About a month before that period ends, we will email you to ask whether you would like us to keep your profile for another 12 months. If you do not reply, we delete or anonymise it. You can change your mind at any time by contacting us, and we will remove your profile.

Keeping your profile is entirely optional. It has no effect on your current application.

If we contacted you but you did not apply

If we approached you about a role and no application followed, we delete or anonymise your details after 6 months without contact, unless you have told us you would like us to keep them for longer.

Interview transcripts, summaries and notes

Where your interview was transcribed, we delete the transcript and the AI-generated summary once the recruitment process for that role has concluded. The interviewer’s own written feedback is kept with your application and follows the periods above.

If we offer you a role and you accept

We keep the information we need for your employment, including your CV, offer and relevant interview context. From that point, the privacy notice for Duna employees, or the notice provided by your employer of record, explains how your data is handled.

Legal claims and legal obligations

If we need specific information to deal with a legal claim or to meet a legal requirement, we keep only what is necessary for that purpose, limit who can access it, and delete it once the need has passed.

If you have any questions about how long we hold your information, contact recruiting-privacy@duna.com.

10. Your rights

Subject to the applicable legal conditions, you can request access to, correction or deletion of your personal data, restriction of processing, or a portable copy of your data. You can object to processing based on legitimate interests, including our use of your professional information for sourcing. If you would like us to remove you from our records, email us. We will delete your information unless retaining limited information is necessary to comply with a legal obligation or to establish, exercise or defend a legal claim. If an exception applies, we will explain it to you.

Where we rely on your consent, you can withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.

Contact recruiting-privacy@duna.com to exercise your rights. We normally respond within one month. If a lawful extension is needed, we will explain it within that month.

You can lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch data protection authority, or with the competent authority where you live or work or where an alleged infringement occurred. Where UK data protection law applies, you may also complain to the Information Commissioner’s Office.

11. Updates to this policy

We will publish updates on this page and change the date above. Where required, we will notify you of material changes to how we use your information.