Privacy

Permitted is a free job search for people who need a highly skilled migrant permit to work in the Netherlands. You can search without an account. If you create one, we store only what we need to send you matching jobs.

Who is responsible

The controller of your personal data under the GDPR is:

Permitted is in beta. The full company details of the operator will be published here before the public launch.

What we store

• Account: your email address, and your name if you sign in with Google. We do not receive your Google password.
• Job preferences: the roles or skills, cities, age bracket (under 30, 30 or older, recent graduate) and whether you speak Dutch. We use the age bracket only to compare pay with the IND salary threshold. We do not ask for your date of birth.
• Emails we sent you: which jobs were in each morning email, and whether you unsubscribed.
• Apply clicks: when you click "Apply at employer", we record the job and the time, linked to your account if you are signed in. If you are not signed in and accepted statistics cookies, it is linked to a random session id; otherwise to nothing at all.
• Reports: if you report that an employer would not sponsor you, we store that report with your account.
• Feedback: what you write in the feedback form, and your email only if you add it.

We do not store your IP address with any of this in our database, we do not sell data, and we do not show advertising. Our hosting and sign-in providers keep short-lived technical logs, which include IP addresses, for security.

Why, and on what basis

• Your account and preferences, to show and email you jobs you asked for. Basis: your consent and our agreement with you to provide the service (GDPR art. 6(1)(a) and (b)).
• Apply clicks and reports, to keep the job list accurate and to see which listings help people. Basis: our legitimate interest in a reliable service (art. 6(1)(f)).
• Statistics cookie, only with your consent (art. 6(1)(a)). See Cookies.

Who processes it for us

• Supabase: database and sign-in, hosted in the EU (Frankfurt).
• Vercel: hosting of the website.
• Google: only if you choose "Continue with Google".
• Resend: sending the morning email.

Where a processor may handle data outside the EU, the transfer is covered by the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long we keep it

Your account and preferences stay until you delete them. Email records, reports and apply clicks linked to you are deleted with your account. Feedback is deleted once we have dealt with it.

Your rights

You can see and change your preferences on your account page, and delete everything at once with "Delete my data" there. That removes your account, preferences, email records, reports and apply clicks. You also have the right to access, correct, export and object; write to us at the address above. You can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Job ads

Job ads come from employers' own public career pages. When you click "Apply at employer" you leave Permitted, and that employer's privacy policy applies.