Privacy Policy

Last updated: 29 June 2026

‍

Carv.com B.V. (“Carv”, “we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, and protect personal data when you visit our website, contact us, subscribe to our newsletter, apply for a role with us, or participate in our webinars.

This Privacy Policy applies to the website located at www.carv.com and to the communications arising from your use of it. It does not apply to the processing of personal data we carry out on behalf of our customers in the course of providing our recruitment-platform services; that processing is governed by separate contractual agreements and data processing terms.

‍

1. Who we are

‍

Carv.com B.V. is the data controller responsible for the personal data collected through this website.

Carv.com B.V. is a Dutch private limited liability company, registered with the Dutch Chamber of Commerce under number 84849738, with its registered office at Danzigerkade 15 C, 1013 AP Amsterdam, the Netherlands.

Please note: Carv.com, Inc. is a separate US entity. Where that entity is involved in processing personal data (for example, in connection with sales, marketing, or support activities directed at website visitors), this will be described in the relevant section below. It acts as a processor on behalf of Carv.com B.V. and does not independently determine the purposes or means of that processing. If you have questions about which entity is responsible for processing your data, please contact us..

Carv has appointed a Data Protection Officer. For all privacy-related questions, please contact us at: privacy@carv.com

‍

2. Scope of this policy

‍

This policy covers personal data collected and processed by Carv.com B.V. in its capacity as a data controller across all of its business activities, including:

Visitors to www.carv.com (contact forms, newsletter sign-ups, webinar registrations, general browsing).
Prospects and customers (sales outreach, account management, billing, and support).
Employees, contractors, and job applicants.
Vendors and professional service providers.

It does not cover:

Personal data that Carv processes as a data processor on behalf of its enterprise customers within the recruitment platform. That processing is governed by the applicable Data Processing Agreement and the relevant customer's own privacy notice. Candidates and other individuals whose data is processed by Carv in its processor capacity should refer to the privacy notice of the relevant customer (the data controller).
Any processing by third-party websites to which this site may link.

‍

3. How to contact us

‍

Carv.com B.V - Danzigerkade 15 C, 1013 AP Amsterdam, the Netherlands.
Email: privacy@carv.com

‍

4. Personal data we process by activity

‍

The table below sets out the personal data we process, the purpose, legal basis, recipients, and retention period for each processing activity. This provides a complete overview in one place.

Activity	Personal data	Purpose	Legal basis	Recipients
Contact form/demo request	Name, business email, message and phone number	Responding to enquiries, sales follow-up	Legitimate interest / pre-contractual steps (Art. 6(1)(b)(f) GDPR)	CRM, email provider, hosting provider
Newsletter	Email address, preferences, opt-in proof	Send newsletter and marketing updates	Consent (Art. 6(1)(a) GDPR)	Email marketing provider
Webinars	Name, email, company, job title, IP address, attendance logs	Registration, confirmations, reminders, post-event follow-up	Legitimate interest / contractual necessity (Art. 6(1)(b)(f) GDPR)	Webinar platform, CRM, hosting provider
Marketing follow-up from webinars	Name, email, company, marketing engagement data	Commercial follow-up and marketing communications	Consent (Art. 6(1)(a) GDPR)	CRM, email marketing provider
Webinar recording	Audio-visual data where you are visible or audible	Making recording available to registrants; internal training	Consent (Art. 6(1)(a) GDPR)	Webinar platform, internal teams
Job application	CV, contact details, work experience, education, interview notes, references	Assessing suitability; running the recruitment process	Pre-contractual steps / legitimate interest (Art. 6(1)(b)(f) GDPR)	ATS, HR, interviewers, and recruitment service providers
Website analytics	IP address, device, browser, pages visited, timestamps	Analytics, security, website improvement	Consent or legitimate interest depending on cookie type (Art. 6(1)(a)(f) GDPR)	Analytics provider, hosting provider
Customer account and authentication	Name, job title, business contact details, contract correspondence, signatures	Negotiating, executing, and managing customer and partner agreements	Contractual necessity Art. 6(1)(b) / legal obligation Art. 6(1)(c)	Internal legal/finance teams, e-signature provider, legal advisers
Billing and invoicing	Name, business email, company, billing address, payment records	Issuing invoices, processing payments, accounting	Contractual necessity Art. 6(1)(b) / legal obligation Art. 6(1)(c)	Billing platform, payment processor, accounting software, auditors
Customer support and onboarding	Name, email, support correspondence, platform usage context, ticket metadata	Responding to support requests; onboarding assistance	Legitimate interest / contractual necessity (Art. 6(1)(b)(f) GDPR)	Helpdesk/support platform, CRM, internal support team
Employment and contractor management	Name, contact details, ID documents, bank details, tax/social security information, employment history, performance data, payroll records	Managing the employment or contractor relationship; payroll; compliance with employment and tax law	Contractual necessity Art. 6(1)(b) / legal obligation Art. 6(1)(c)	HR platform, payroll provider, pension provider, tax authorities, occupational health where applicable

‍

5. Cookies and similar technologies

‍

We use cookies and similar technologies to ensure our website functions properly, to understand how visitors use the site, and to improve performance and user experience.

We distinguish between the following categories of cookies:

Necessary cookies: required for the website to function; no consent needed.
Analytics cookies: help us understand how visitors interact with the website. Where required by law, we will only set these with your consent.
Marketing/tracking cookies: used to serve relevant advertising and track campaign performance. These require your consent.
Preference cookies: remember your settings and choices.

Non-essential cookies are only placed after you have given consent via our cookie banner. You can withdraw or change your consent at any time through our cookie preference centre.

For detailed information about the specific cookies and similar technologies we use, including their names, providers, purposes, categories, and retention periods, please see our Cookie Policy.

‍

6. Newsletter and marketing communications

‍

If you subscribe to our newsletter, we will use your email address to send you news, updates, and information about Carv that we believe may be of interest to you.

The following rules apply to our marketing communications:

Newsletter subscription is always via a non-pre-checked opt-in box. We retain proof of consent, including the date, source, form text, and (where applicable) IP address.
Every marketing email contains an unsubscribe link. You may also unsubscribe by contacting us at privacy@carv.com.
After you unsubscribe, we will retain your email address on a suppression list to ensure we do not contact you again, unless you re-subscribe.
If you do not provide your email address or consent, you will simply not receive our newsletter.

‍

7. Webinars and online events

‍

When you register for or participate in a Carv webinar, we collect and use your personal data as described in the relevant section. We distinguish between:

Logistical communications (confirmations, reminders, practical follow-up): these are sent based on legitimate interest or contractual necessity and do not require separate consent.
Commercial marketing follow-up (promotional content, product updates, offers): this requires a separate opt-in. Where a soft opt-in applies under applicable law, we will comply with the relevant requirements.

If a webinar is recorded and you may be visible or audible, we will inform you in advance and request your consent before the recording begins. You may decline to be recorded without affecting your ability to participate.

You may unsubscribe from webinar marketing communications at any time using the unsubscribe link in any marketing email or by contacting us at privacy@carv.com.

‍

8. Sharing your personal data

‍

We may share your personal data with the following categories of recipients:

Service providers and vendors that help us operate our website, send communications, host data, provide analytics and security services, or host webinars (e.g. CRM providers, email marketing platforms, webinar tools, hosting providers, analytics tools).
Professional advisers such as lawyers, accountants, auditors, and insurers.
Public authorities and regulators where disclosure is required by law or necessary to protect our rights.
Third parties involved in a corporate transaction such as a merger, acquisition, reorganisation, or sale of assets.

We do not sell your personal data. All service providers are required to process your data only on our instructions and in accordance with applicable data protection law.

‍

9. Recruitment and career applications

‍

When you apply for a role with Carv, we process your application data to review your application, contact you about the recruitment process, arrange interviews, and assess your suitability for the role.

Retention of application data:

If your application is unsuccessful, we will normally retain your application data for up to 4 weeks after the recruitment process ends.
If you consent to being considered for future opportunities, we may retain your data for up to 12 months from the end of the process, unless you withdraw your consent earlier.
If you do not provide the information required to assess your application, we will not be able to proceed with your application.

We do not wish to receive special category personal data (e.g. health, ethnicity, religion) via job applications unless specifically requested or legally permitted.

‍

10. International data transfers

‍

Some of our service providers may be located outside the European Economic Area (EEA). Where we transfer personal data outside the EEA, we rely on an adequacy decision where available (e.g. for transfers to the United Kingdom, Switzerland, Canada for commercial organisations, and the United States for organisations participating in the EU–US Data Privacy Framework).

Where no adequacy decision applies, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs), supplemented where necessary by additional contractual, technical, and organisational measures.

Types of suppliers that may be located outside the EEA include: cloud hosting providers, CRM and email marketing platforms, webinar tools, analytics providers, and professional services firms. Where relevant, we will carry out a transfer impact assessment.

‍

11. Retention periods

‍

We retain personal data only for as long as necessary for the purposes for which it was collected, in accordance with the periods set out in the table below.

Our standard periods for holding data include the following examples:

Enquiry data: held for the time necessary to address your specific request and, where appropriate under applicable law, for a further duration to manage potential commercial relationships.
Newsletter data: processed until you withdraw your consent or choose to unsubscribe.
Webinar data: retained during the event and for a reasonable duration thereafter to support internal reporting and service enhancements.
Career application data: kept for the duration of the recruitment cycle and, where lawful, for a justified period following the process conclusion.
Technical and analytics data: stored for a limited timeframe as required by our security and operational standards.
Billing and invoicing data: 7 years (Dutch statutory tax and accounting retention obligation).
Employment and contractor data: duration of engagement + 7 years.
Vendor and supplier data: duration of relationship + 7 years.

Once personal information is no longer required for these purposes, we will ensure it is securely erased or rendered anonymous.

‍

12. Data security

‍

Carv applies technical and organisational measures designed to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures include:

• An Information Security Management System certified to ISO/IEC 27001.

• SOC 2 Type II attestation for security, availability, and confidentiality.

• ISO/IEC 42001 certification covering the management of AI systems.

• Encryption of personal data in transit and at rest.

• Role-based access control, multi-factor authentication, and least-privilege principles for personnel access to systems processing personal data.

• Monitoring, logging, and incident response processes, including a documented Personal Data Breach Notification Procedure.

• Regular vulnerability scanning and layered security testing.

Further detail on Carv's security program is published at compliance.carv.com/security and is available to enterprise Customers and prospects under a non-disclosure agreement.

‍

13. Your rights

‍

Depending on your location and applicable data protection law, you may have the right to:

Access your personal data.
Correct inaccurate or incomplete data.
Delete your personal data (“right to erasure”).
Restrict or object to certain processing activities.
Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.
Receive your personal data in a structured, commonly used, machine-readable format (data portability).
Lodge a complaint with your local data protection authority.

To exercise any of these rights, please contact us at privacy@carv.com. We may ask you to verify your identity before acting on your request.

‍

14. Automated decision-making and profiling

‍

We do not use personal data collected through this website to make decisions based solely on automated processing that produce legal effects or similarly significant effects for you.

We may use limited profiling to understand general business interest in our services, for example, by analysing website interactions, webinar participation, or marketing engagement (e.g. through lead scoring in our CRM). This does not produce legal effects or otherwise significantly affect you. You may object to such processing at any time by contacting us at privacy@carv.com.

‍

15. Children’s privacy

‍

Carv's website and recruitment platform services are intended for business users and adult candidates engaged in professional recruitment processes. We do not knowingly direct our services to children under the age of 18, and we do not knowingly collect personal data from children through our website or platform.

If Carv becomes aware that personal data relating to a child has been collected without an appropriate lawful basis, it will take prompt steps to delete that data. If you believe we have inadvertently collected personal data from a child, please contact dpo@carv.com.

Please do not include special category personal data (health, ethnicity, religion, etc.) in contact forms or job applications unless we have specifically requested it or are legally permitted to collect it.

California residents should note that Carv does not knowingly collect or sell the personal information of consumers under the age of 16.

‍

16. Jurisdiction-specific notices

‍

EU / EEA

Your rights and our obligations are governed by the GDPR. You may exercise the rights described in this policy through the contact details set out above.

United Kingdom

Your rights are governed by the UK GDPR and the Data Protection Act 2018. The same rights and principles apply, and we will respect UK-specific rules on transfers and safeguards.

Switzerland

Your rights are governed by the Federal Act on Data Protection (FADP). We ensure that our processing is lawful, transparent, and proportionate.

United States and Canada

Additional rights may apply depending on the state or province where you reside. For example, California residents may have rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know, delete, correct, and opt out of the sale or sharing of personal information. Canadian residents may have rights under PIPEDA or applicable provincial privacy legislation.

If you are located in the US or Canada and wish to exercise any applicable rights, please contact us at privacy@carv.com, and we will respond in accordance with applicable law.

‍

17. Changes to this Privacy Policy

‍

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or website features. The updated version will always be posted on this page with a revised “Last updated” date. We recommend that you review this page periodically.

‍

18. Contact and complaints

‍

Carv.com B.V.: Danzigerkade 15 C, 1013 AP Amsterdam, the Netherlands.
Email: privacy@carv.com

If you have a concern about how we handle your personal data and we have not been able to resolve it to your satisfaction, you have the right to lodge a complaint with a data protection supervisory authority.

As Carv.com B.V. is established in the Netherlands, you may contact the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):

Website: www.autoriteitpersoonsgegevens.nl
Telephone: +31 (0)70 888 85 00

If you are located in another EEA member state, you may also contact your local supervisory authority.