Privacy Policy

Applies to

Platform users, candidates, website visitors, business contacts, job applicants to Marty, professionals in our sourcing database and Marty Jobs users.

This Privacy Policy explains what personal data Marty collects, why, and what rights you have. It covers several relationships, so please read the section that applies to you. See also our Terms and Conditions, MSA, DPA and Cookie Policy.

Who we are

The controller is TEŽINSKI GRAF d.o.o., Ulica Ljudevita Posavskog 34A, 10000 Zagreb, Croatia, OIB 66900544338, operating the Marty platform (“Marty”, “we”, “us”). Contact: Request Center.

Websites and services covered

This policy applies to the following websites and services operated by Marty:

Domain	What it is
marty.hr	Marty website
app.marty.hr	Marty platform
public.marty.hr	Public pages of the Marty platform
api.marty.hr	Marty API
developers.marty.hr	Developer documentation
support.marty.hr	Help center and support
martyjobs.com	Job board for candidates

Customer career sites are not covered. Career sites and job pages hosted on customer subdomains (e.g. company.marty.hr) or on custom domains are operated by our customers. The customer is the controller of personal data collected there and is solely responsible for the content published and for its own privacy notice, which you will find on that career site. Marty only provides the technology and processes the data on the customer’s behalf (see Section 1).

Which section applies to you

You are	Marty’s role	Section
Candidate, employee or interviewee of a Marty customer – your data is managed in the customer’s ATS, screening, assessments, notetaker, surveys or HRIS	Processor for that customer	1
Platform user – you use Marty on behalf of a customer, or are a customer’s billing contact	Controller	2
Website visitor – you browse our websites	Controller	3
Business contact or prospect – you are a contact at a current or potential customer or partner, or an event attendee	Controller	4
Professional in our sourcing database – your profile is in our database, even if you never contacted us	Controller	6
martyjobs.com user – you have an account on martyjobs.com	Controller	7

1 When Marty Processes Data for Its Customers

When Marty acts on behalf of a customer. If you applied to a company that uses Marty, were contacted by a recruiter through Marty, were interviewed with our notetaker, or your employer uses Marty HRIS, that company is the controller. We process your data only on its instructions under our DPA. Please contact that company first; if you contact us, we will forward your request to it.

Online assessments. If a company invites you to an online assessment through Marty, it may enable anti-cheating measures, such as device fingerprinting, webcam snapshots and screen recording. You will see which measures are active before you start the test. This data is processed on the company’s behalf, only to protect the integrity of the test, and is kept for as long as the company decides. Webcam snapshots are not used for facial recognition or biometric identification.

Our services are intended for businesses and adult professionals. We do not knowingly collect data of children under 16. If we learn that we have, we delete it promptly.

2 Customers and Users of the Platform

This section applies to people who use the Marty platform on behalf of a customer (recruiters, hiring managers, HR administrators) and to customer billing contacts.

2.1 What we collect and where it comes from

Data	Examples	Source
Account data	Full name, business email, business phone, job title, profile image (optional), company, role and permissions	You, or your company’s administrator who invites you
Sign-in data	Name, email and profile photo from Google, Microsoft or your company’s SSO	Your identity provider, when you choose to sign in with it
Billing data	Billing contact, company details, VAT number, purchase history	You or your company. Card payments are handled by Stripe; we do not store full card numbers
Usage and device data	IP address, approximate location, browser and device details, login/logout times, feature usage, logs	Collected automatically when you use the platform
Support data	Messages, attachments, call notes	You, when you contact support via chat, email or phone
Survey and feedback data	Answers to product surveys (optional)	You
Aggregated and anonymised data	Usage statistics, feature adoption, hiring funnel metrics (e.g. time-to-hire, conversion rates) and benchmarks combined across many customers	Derived by us from use of the platform; irreversibly anonymised so it identifies neither individuals nor customers, and is then no longer personal data. Used to improve the platform, publish benchmarks and for research

2.2 Purposes and legal bases

Purpose	Legal basis (GDPR)
Creating and managing accounts, providing the platform and support	Contract with you or your company, Art. 6(1)(b); legitimate interests, Art. 6(1)(f)
Service communications (security alerts, changes to the service, billing)	Contract, Art. 6(1)(b)
Billing, accounting, tax	Contract and legal obligation, Art. 6(1)(b), (c)
Security, fraud and abuse prevention, logging	Legitimate interests, Art. 6(1)(f)
Product improvement, analytics and aggregated statistics	Legitimate interests, Art. 6(1)(f)
Handling legal claims and requests from authorities	Legal obligation and legitimate interests, Art. 6(1)(c), (f)

2.3 Support access to your account

When you ask our support team for help, an authorised Marty employee may access your account to resolve the issue and will see it as you do. We may also access an account without prior notice where necessary for security (e.g. investigating a bug or abuse) or to comply with law. All such access is logged.

2.4 Google user data

Users may sign in with Google and connect Gmail and Google Calendar to send emails, detect replies and schedule interviews. We access only the scopes shown on Google’s consent screen, solely to provide those features. Our use of data from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

When you	We access	To
Sign in with Google	Name, email, profile photo	Verify your email, create and link your Marty account, show your name and photo
Connect Gmail	Send, read and modify emails related to candidates; attachments	Send emails to candidates from your mailbox, import and sync candidate email threads, mark messages read/unread or archived, show and download candidate attachments
Connect Google Calendar	Calendars, events, free/busy of attendees	Schedule interviews, show availability, sync attendance and event changes made in Google Calendar

You can disconnect Google at any time in your Marty settings or in your Google Account permissions; we then stop accessing your Google data and delete synced data that is not part of candidate records.

we use Google user data only for the user-facing features you connected;
we do not sell it, use it for advertising, or transfer it to third parties except as needed for those features, to comply with law, or in a business transfer with notice;
humans do not read it unless you agree, it is needed for security or law, or it is aggregated and anonymised;
we do not use Google user data to develop, improve or train generalised AI or ML models. Where an AI provider processes it to provide a feature (e.g. detecting a candidate reply), the provider is contractually prohibited from training on or retaining it.

2.5 Retention

Data	Retention
Account and usage data	Term of the subscription, then deleted within 90 days of termination, unless you request earlier deletion
Billing records	11 years, as required by Croatian accounting law
Logs	Up to 12 months
Support conversations	Up to 3 years after the conversation

You can update your profile at any time in the platform settings.

3 Website Visitors

This section applies when you visit marty.hr, martyjobs.com or our help center.

What we collect: IP address, device and browser details, pages visited, referring site, time on site, and details you enter in contact or demo forms (name, job title, work email, phone, company, message).
Cookies: essential cookies are always on; analytics, functional and marketing cookies are used only with your consent. See our Cookie Policy.
Legal bases: legitimate interests for running and securing the website and answering enquiries (Art. 6(1)(f)); consent for non-essential cookies (Art. 6(1)(a)).
Retention: analytics data is anonymised or aggregated after 14 months; enquiries are kept for up to 24 months unless you become a customer.
Third-party websites: our websites may link to partner sites. Those sites have their own privacy policies, and we are not responsible for them.

4 Business Contacts and Prospects

This section applies to business contacts at current and prospective customers, partners and event attendees.

What we collect: name, work email, phone, job title, company, professional profile URL, and your interactions with our emails and events.
Sources: you (e.g. demo requests, webinars, events, newsletter sign-ups); B2B data providers that supply publicly available business contact information; advertising partners (if you consented to marketing cookies).
Purposes: sending newsletters and product updates, B2B outreach about our services, managing our CRM, event organisation, and measuring campaigns.
Legal bases: legitimate interests for B2B marketing directed at you in your professional capacity (Art. 6(1)(f)); consent where required by e-privacy rules, e.g. for newsletters to non-customers (Art. 6(1)(a)).
Your choice: you can unsubscribe from any email or object to marketing at any time via the unsubscribe link in our emails or through our Request Center.
Retention: until you unsubscribe or object; inactive contacts are reviewed and deleted after 24 months. We keep a minimal suppression record so we do not contact you again.

5 Job Applicants to Marty

If you apply for a job at Marty, your data is processed under our separate recruitment privacy notice, which you will find in the job ad and on our careers page [link].

6 Professionals in Marty’s Sourcing Database

This section is for you if your professional profile is in our sourcing database, even if you have never contacted Marty. Marty is the controller of that database. We publish this section to inform you under Article 14 GDPR.

6.1 What we hold

Name and public professional profile identifiers (e.g. profile URLs);
Job titles, employers, dates and work locations;
Education, qualifications and certifications;
Location at city or region level;
Skills, languages and areas of expertise;
Publicly available professional information such as headlines, summaries and publications.

We do not hold special categories of data (e.g. health, ethnicity, religion, political opinions) as fields in the database, and we do not use them for matching or ranking. We also do not hold photos or dates of birth, and we hold profiles only for the regions and professional fields our customers recruit in.

Contact details are not part of the database. When a customer chooses to obtain your email or phone number for a candidate it identified, that enrichment happens on the customer’s instruction and on its behalf. The customer is the controller of your contact details and of any outreach, and its own privacy notice applies.

Marty Jobs profiles. If you have a Marty Jobs account and your profile is visible to employers, employers may also find it through our sourcing search. That profile is processed under Section 7, on the basis of your Marty Jobs account, not under this section, and is marked as a Marty Jobs profile in search results.

6.2 Where the data comes from

We do not collect it from you directly. Profiles come from licensed third-party professional data providers that compile information from publicly available professional sources. Each provider must have its own lawful basis, and we carry out due diligence before using it. You can ask us which provider supplied your profile.

Why we do not notify everyone individually. Our database contains no contact details. Notifying each person would require us to obtain additional personal data (email or phone) for millions of people who will never be contacted by an employer, and to send them unsolicited messages. We consider this disproportionate and more intrusive than the processing itself (Art. 14(5)(b) GDPR). Instead, we publish this notice, offer a profile lookup and opt-out, and ensure everyone who is actually contacted is informed at first contact.

6.3 Why we process it and on what basis

We operate an AI-powered sourcing service that helps employers find suitable candidates for professional roles. We:

maintain a searchable database of professional profiles;
apply AI matching and ranking in response to employer searches;
show relevant profiles to employer customers.

Our legal basis is legitimate interests (Art. 6(1)(f) GDPR): our interest in providing a sourcing service, the employers’ interest in finding talent, and your potential interest in career opportunities. We have carried out a legitimate interests assessment, which you can request.

6.4 AI matching

AI compares profiles with an employer’s search criteria. No permanent score or ranking is stored on your profile outside a specific search. Employers review the results and decide themselves whether to contact you; Marty makes no decisions about you. We do not use special category data as inputs and we monitor our systems for fairness. You can ask us for information about the logic involved. Because Marty takes no decisions about you, questions about or objections to a specific decision should be addressed to the employer that made it.

Employer customers who find your profile in a search. From the moment they save your profile or contact you, they become an independent controller and their privacy notice applies. We do not contact you ourselves. If an employer obtains your contact details and writes to you through Marty, its first message always includes a notice from us explaining that your profile comes from Marty’s sourcing database, where the data came from, and how to opt out.
Service providers (hosting, search, AI model providers) under data processing agreements.

6.6 Retention

We keep your profile while it remains current in our provider’s dataset; outdated profiles are deleted at the next refresh, and at the latest 12 months after it was added or last refreshed. If you opt out, we delete your profile and keep only a minimal suppression record (e.g. a hashed identifier) so it is not re-added in future refreshes.

6.7 Your rights

Right	What it means
Access (Art. 15)	Ask whether we hold a profile about you, get a copy and its source
Erasure (Art. 17)	Ask us to delete your profile; we also prevent re-ingestion
Objection (Art. 21)	Object at any time; we will stop unless we have compelling grounds, which in practice means we remove you
Rectification (Art. 16)	Ask us to correct inaccurate information
Restriction (Art. 18)	Ask us to restrict processing, e.g. while a correction is checked
Information about AI matching	Ask how our AI matching works and which data it uses. Marty makes no decisions about you; any decision is made by the employer, so requests for human review of a decision go to that employer
Complaint	Lodge a complaint with AZOP (azop.hr) or your local supervisory authority

Use our Request Center or our public profile lookup at [marty.hr/sourcing-lookup] to check whether we hold your profile, see its source and opt out with one click. We respond within one month.

7 Candidates on martyjobs.com

If you create an account on martyjobs.com, Marty is the controller of your data.

Your use of martyjobs.com is governed by the martyjobs Terms of Use.

7.1 What we collect

Account and profile data: name, email, CV, profile details, preferences and job alerts you set up.
Activity data: your job searches, the jobs you view and save, and the jobs you apply to through Marty Jobs. For jobs from public sources you are sent to the employer’s own website, and we do not receive applications you make there.
Career profile (generated by AI): based on your searches and activity, our AI suggests what you are likely looking for, e.g. target roles, seniority, skills, preferred locations, work type and desired salary range. Our AI may also show you how well a job matches your profile; this indication is shown only to you.

7.2 How we use it and on what basis

Purpose	Legal basis
Running your account, search and job alerts	Contract, Art. 6(1)(b)
Generating your career profile and personalised job recommendations	Contract, Art. 6(1)(b) – it is part of the service you signed up for
Making your career profile visible to employers so they can contact you	Contract, Art. 6(1)(b) – showing your profile to employers is the core of the martyjobs.com service you sign up for
Security and abuse prevention	Legitimate interests, Art. 6(1)(f)

7.3 Your control

You can view, edit or delete your career profile at any time. AI suggestions are only suggestions; what you confirm or change takes priority.
Your profile is shown to employers as part of the service, as explained when you register. You can pause visibility at any time (e.g. when you are no longer looking for a job) or delete your account. This does not affect contacts employers already made.
You can object to profiling for recommendations; we will then show you non-personalised results.
No decision with legal or similarly significant effect is made about you automatically. Employers decide whether to contact you.

When your profile is visible, employers using Marty can see your career profile and contact you. When you apply to a job or reply to an employer, your data goes to that employer, which becomes an independent controller; from then on its privacy notice applies.

7.5 Retention

We keep your account while it is active. Inactive accounts (no login and no response to job alerts for 36 months) are deleted after a reminder email. Search and activity data used for your career profile is kept for up to 12 months.

8 AI

Marty uses AI features, including large language models, for example to match profiles in the sourcing database (Section 6) and to build career profiles on martyjobs.com (Section 7). We do not use customer data, candidate data or Google user data to train general-purpose AI models, and our AI providers are engaged on terms that exclude training and limit retention. How we develop, test and oversee our AI is described in Annex C of the Terms and Conditions.

Sub-processors and service providers for hosting, email, authentication, support, payments, analytics and AI – listed in Annex 3 of the DPA;
Marketplace partners you choose to connect; their own terms apply;
Employer customers, as described in Sections 6 and 7;
Advertising platforms, only if you consented to marketing cookies;
Authorities, where required by law;
Acquirers, in a merger or sale of the business, with notice.

We do not sell personal data.

10 International Transfers

We host data in the EU. Some providers are outside the EEA (e.g. in the USA). For each such transfer we use Standard Contractual Clauses approved by the European Commission, with supplementary measures where needed, or rely on an adequacy decision where it applies (for US providers, where the provider is certified under the EU–U.S. Data Privacy Framework). You can request a copy of the safeguards.

11 Security

Marty’s information security management system is certified to ISO/IEC 27001. We apply technical and organisational measures including encryption in transit and at rest, MFA, role-based access, tenant separation, logging, backups and regular testing. Details are in Annex 2 of the DPA. If a breach affects your data, we will notify you and the authorities as required by law.

12 Your Rights

Under the GDPR you have the right to access, rectification, erasure, restriction, data portability and objection, including objection to direct marketing at any time, and to withdraw consent without affecting prior processing. Customers can export their data at any time via the Marty API and receive one complete export free of charge when their subscription ends. We respond within one month and may ask you to verify your identity. You may complain to the Croatian Personal Data Protection Agency (AZOP), azop.hr, or your local authority.

You also have the right not to be subject to a decision based solely on automated processing that significantly affects you, and the right to compensation for damage caused by a breach of data protection law.

How to make a request. Submit your request through our Request Center and tell us what your request relates to. To protect your data, we must verify your identity: if you are a User, a request from the email address registered with Marty is usually enough; otherwise we may ask for additional information, but never more than needed. Requests are free unless manifestly unfounded or excessive.

13 Changes

We may update this policy. Significant changes will be announced on our website and, for Users, by email or in-app at least 30 days in advance.

14 Contact

Privacy requests: Request Center
Sourcing database opt-out: Request Center
Post: TEŽINSKI GRAF d.o.o., Ulica Ljudevita Posavskog 34A, 10000 Zagreb, Croatia
Data Protection Officer: [name / [email protected] – confirm whether a DPO is appointed]