Privacy Policy

1. What does this Privacy Policy mean?

In this privacy policy (hereinafter referred to as the Privacy Policy), we provide you with information about who collects, uses, stores and otherwise processes your personal data when you use the Oftet mobile application or the equivalent functionality of the website www.oftet.com (hereinafter collectively referred to as the OFTET platform), what information we collect through cookies when using OFTET, what rights you have in relation to your personal data and how you may exercise them, and how you can defend your rights if you believe that the processing of your personal data is unlawful and/or that your rights have been infringed.

It is important to us that you understand the information provided, which is why we explain certain terms used herein. Any person whose data we process for the purposes specified in this Privacy Policy is referred to as a data subject. Any action performed with personal data (collection, use, storage, etc.) is referred to as processing of personal data.

2. Who is your data controller?

The data controller responsible for the processing of your personal data as specified in this Privacy Policy is:

Oftet, UAB

Legal entity code: 307115766

Registered office address: Laisvės pr. 60-1107, LT-05120 Vilnius, Lithuania

Telephone number: +370 646 99594

Email address: [email protected]

Data protection officer contact: [email protected]

3. What are personal data?

Personal data includes any information, including name, surname, address, video and audio recordings, technical information related to your activities on the OFTET platform, and other information that allows you to be identified directly or indirectly, which Oftet, UAB (hereinafter referred to as the Company, we) collects about natural persons for the purposes specified in this Privacy Policy.

When processing personal data, the Company complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania, the Law on Electronic Communications of the Republic of Lithuania, and other legal acts regulating the protection of personal data.

Below you can find out how we process your personal data: what personal data we process, for what purposes we process them, how long we store them, and what rights you have. You can do this by clicking on the option that interests you.

4. Processing of personal data of job seekers

4.1. Registration on the OFTET platform and creation and administration of an account

If you wish to use the OFTET platform, we will ask you to register and create an account. You can do this in several different ways, and the scope of personal data processed for registration purposes on the OFTET platform will depend on which method you choose:

a)Registration with your phone number: in this case, we will ask you to provide the phone number of which you are the subscriber. If you do not provide a phone number, we will not be able to allow you to use this registration method on the OFTET platform. When you register with a phone number, we will send a one-time code to the phone number to authenticate you.
b)Registration with Google: if you choose this registration method and consent to it, we will receive and process the following personal data from Google: name and surname (if you have a complete profile on your Google account), email address (linked to the Google account).
c)Registration with Facebook: if you choose this registration method and consent to it, we will receive and process the following personal data from Facebook: Facebook username, email address.
d)Registration with Apple: name (linked to the Apple account), email address (linked to the Apple account).

When you register with Google, Facebook or Apple, we will receive your personal data not directly from you, but from Google, Facebook or Apple respectively, depending on which registration method you choose.

For the purpose of creating and administering your account, in addition to registration data, we will also process the following personal data: information about the country you are from, information about the country where you wish to work, information about the preferred type of work, your name, surname, photograph, email address, phone number, links to your social networks, as well as information such as methods of logging into the application, selected language in OFTET, information about OFTET platform notification settings, and data on logins to the OFTET platform.

You are not obliged to provide us with the following personal data: photograph, links to your social networks; however, in such a case you may lose increased visibility and reduce your chances of finding the job you want.

We will process the specified personal data on the basis of your consent (Article 6(1)(a) of the GDPR) insofar as it relates to receiving your personal data from Google, Facebook or Apple during registration, processing of your photograph and links to social networks, and we will process other data specified in this section on the basis of the contract (Rules for Use of the OFTET Platform) with you (Article 6(1)(b) of the GDPR).

We will store the data until the account on the OFTET platform is deleted or until consent is withdrawn, whichever occurs first. Please note that you may at any time independently deactivate or permanently delete your account in the Settings section "Account Security" on the OFTET platform. When the account is deactivated, your data will not be deleted or destroyed, but your profile will be hidden from other users of the OFTET platform and you will not receive any notifications from the OFTET platform, nor will you be able to access account information or created video and audio recordings. In this case, you will retain the ability to reactivate the account at any time and restore all its content. If you choose to delete the account, the data will be irreversibly destroyed without the possibility of restoring your data and content stored therein.

Your account will be deleted and the personal data contained therein will be destroyed if you do not use the account for more than one year. Before the one-year period expires, we will inform you about the upcoming deletion of your account and destruction of your personal data so that you can take steps to preserve them (the account and personal data) or exercise your data subject rights.

4.2. Provision of services: enabling job seekers to publish their CV, search for job offers and apply by submitting their CV to potential employers

For this purpose, we will process the following personal data:

a)Profile (CV) data: your biography, the content of which you determine yourself; work experience information (positions, name of the organisation where you gained experience, and start and end dates of employment in the organisation); education information (name of the educational institution where education was obtained, specialisation obtained, start and end dates of studies at the institution); uploaded introduction and/or personal story video and audio recordings; public video and audio recordings; your application history (names of organisations to which you applied and how long each of them viewed your video and audio recording); your saved job listings; statistical information (period during which you have been a user of the Application, total number of views of your video and audio recordings, total number of views of your public video and audio recordings, information about sectors whose representatives are most interested in you, profile view information (information about companies that viewed the profile)).
b)Correspondence with organisations to whose job positions you applied: names and content of the organisations with which you correspond, date and time.
c)Your location. IMPORTANT! On the OFTET platform, you have the right to choose whether you wish to allow the OFTET platform to process your approximate or precise location. For greater security, we recommend choosing approximate location.
d)Payment information: information about your OFTET platform usage plan; information about payment transactions that we will receive from financial institutions.

We will process the specified personal data on the basis of the contract (Rules for Use of the OFTET Platform) with you (Article 6(1)(b) of the GDPR), except for your location data, which we will process only if you separately consent to this (Article 6(1)(a) of the GDPR). You may withdraw your consent to process location data at any time.

All specified data are necessary for you to publish your CV and conduct a job search, apply for selected job positions; however, providing certain data is not mandatory. You are not obliged to upload an introduction video and audio recording, a personal story video and audio recording, or public video and audio recordings, nor are you obliged to provide us with your location. If you do not provide introduction, personal story or public video and audio recordings, this may reduce your chances of attracting the attention of potential employers and finding the desired job more quickly. When you provide us with your location, this allows us to show job listings on the map available on the OFTET platform that are closest to your location; if you do not provide your location to us, we will not be able to do this.

IMPORTANT! We provide you with the opportunity to freely choose the content of your biography, and you decide at your discretion what information to share. We recommend avoiding sharing information that is particularly sensitive and, in the event of a personal data security breach, would pose an increased risk to you. Do not share information revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, sex life or sexual orientation.

We will store your personal data for the period of performance of the contract with you or until account deletion, whichever occurs first. If during the specified period grounds arise to process your personal data for the purpose of defending the Company's rights and interests, on the basis of the Company's legitimate interest (Article 6(1)(f) of the GDPR), your personal data, to the extent related to a specific legal dispute, case, complaint, claim, investigation, etc., would be processed and stored until final decisions are made.

We are obliged to store payment information for 10 years in accordance with the Index of Retention Periods for Internal Administration Documents, approved by Order No. V-100 of the Chief Archivist of Lithuania of 9 March 2011.

Recipients of the profile data you provide (your biography, the content of which you determine yourself; work experience information (positions, name of the organisation where you gained experience, and start and end dates of employment in the organisation); education information (name of the educational institution where education was obtained, specialisation obtained, start and end dates of studies at the institution); uploaded introduction and/or personal story video and audio recordings; public video and audio recordings; your application history (names of organisations to which you applied and how long each of them viewed your video and audio recording) and your saved job listings) are employers registered on the OFTET platform. You decide yourself with which specific employers to share your information when applying for specific job positions, or whether to use the public application option, when your profile data will become available to all employers registered on the OFTET platform.

A recipient of your personal data in this case will also be Stripe Payments Europe Ltd, established and operating in Ireland, providing us with services as an electronic money payment institution. This data recipient will receive your data only if you use paid OFTET platform services. Data related to payment (e.g., name, surname, payment amount, credit card data) are transferred to Stripe Payments Europe Ltd. Stripe Payments Europe Ltd is responsible for their processing in accordance with its privacy policy: https://stripe.com/privacy.

4.3. Processing of personal data of employer representatives

If you use the OFTET platform as a representative of an organisation – employer, for the purpose of providing services to your organisation we will process the following personal data: name, surname, represented organisation, position, email, phone number, role (whether you are the organisation account manager, administrator or editor), permissions granted to you on the OFTET platform and access rights, correspondence with candidates, as well as your image if you appear in a video and audio recording uploaded to the OFTET platform.

We will process the specified personal data on the basis of our legitimate interest in order to conclude and perform a service provision contract with the organisation you represent (Article 6(1)(f) of the GDPR).

We will store your personal data for the period of performance of the contract with the organisation you represent or until account deletion, whichever occurs first. If during the specified period grounds arise to process your personal data for the purpose of defending the Company's rights and interests, on the basis of the Company's legitimate interest (Article 6(1)(f) of the GDPR), your personal data, to the extent related to a specific legal dispute, case, complaint, claim, investigation, etc., would be processed and stored until final decisions are made.

Your personal data may also be deleted if the organisation decides to appoint another person to represent it, for example, upon termination of your employment relationship with the organisation you represent, change in the nature of your job duties in the represented organisation, etc.; in such a case, your personal data would not be stored.

5. Sending of notifications

To persons who have allowed the Oftet mobile application in settings to send notifications in the selected manner: push notifications in the application or by email, we will send notifications according to the selected category: notifications about new job offers based on what you saved and where you applied; notifications about profile views, application statuses, incoming conversations.

We will send notifications on the basis of your consent (Article 6(1)(a) of the GDPR) until you change your choice regarding sending notifications in the Oftet mobile application settings.

6. Improvement of the Company's services and operations

We strive for our operations to meet our customers' expectations, which is why it is important for us to hear your feedback. If you decide to share it with us, we will process your name, surname, email address and the content of the feedback.

We will process the specified personal data on the basis of your consent (Article 6(1)(a) of the GDPR).

We will store the data for 1 year, and upon expiry we will destroy them.

7. For the purposes of ensuring information security and compliance with legal requirements

We are interested in ensuring information security, and for this purpose we process certain technical data: identifiers of the device you use (e.g., Advertising ID, Device ID), operating system version, model, browser/SDK information, application version, login and activity logs (log).

We process the specified personal data in order to pursue our interests in ensuring information security (Article 6(1)(f) of the GDPR).

We will store this data for 1 year.

8. Receipt and disclosure of data

We receive your data from you, your devices, banks (regarding payment for the service).

We may disclose information about you to IT service providers if reasonably necessary for the purposes specified in this Privacy Policy, as well as to banks and payment initiation service providers. We provide you with information about recipients of your personal data by explaining the purposes of transferring your personal data:

Category of data recipientsCategories of data transferredTransfer outside the EU/EEA? Recipient located in the USA, included/not included in the Data Privacy Framework list?
Service provider providing cloud computing servicesProfile photo, personal data in documents uploaded to OFTET, video and audio recordingsNo
Service provider providing video and audio streaming and hosting services for video, audio recordings and photosVideo and audio recordings, photosYes, included
Service provider providing email message delivery servicesEmail addresses, email contentYes, not included
Service provider providing hosting platform and application serverAll application dataYes, included
Service provider providing database servicesAll user, company and listing dataNo
Service provider providing cache and session management servicesSession data, cache dataNo
Payment processing service provider (Stripe Payments Europe, Ltd)Payment information, credit card data (via Stripe)Yes, included (Stripe, Inc)
Service provider providing push notification services, error monitoring and loggingPush tokens, notification contentYes, included
Service provider providing SMS verification servicesPhone numbers, verification codesYes, included
Service provider providing error monitoring and logging servicesError logs, technical information, possible IP addressYes, included
Service provider providing geolocation servicesIP addresses, geographic coordinatesYes, included
Service provider providing map services (iOS application)Geographic coordinates, map dataYes, included

In addition, we may disclose information about you:

● if we are required to do so by law;

● when intending to sell part of our business or its assets, by disclosing your personal data to a potential buyer of the business or part thereof, on the basis of our and the potential buyer's legitimate interest – to assess the acceptability of the transaction for both us and the potential buyer (Article 6(1)(f) of the GDPR). We undertake to ensure that in such a case your personal data will be transferred only when necessary, with the potential buyer committing to ensure confidentiality and agreeing on the terms of personal data transfer, the procedure for destruction of transferred data and liability;

● after selling our business or its essential assets to third parties, on the basis of our and the new acquirer's legitimate interest – to transfer/acquire the business or part of assets while maintaining business continuity (Article 6(1)(f) of the GDPR).

Except for the cases provided for in this Privacy Policy, we do not provide your personal data to any third parties.

The list of recipients or categories of recipients specified in the Privacy Policy may change; therefore, if you wish to be informed about changes in recipients of your personal data, please notify us at the email address specified in this Privacy Policy, stating in the email text: "I wish to receive information about changes in recipients of my personal data, name, surname". We also undertake to continuously update and publish information about data recipients.

9. Transfer of data to third countries

In the cases and to the extent specified in the table in Section 8 of the Privacy Policy, we transfer personal data to the United States of America. Please note that the United States of America has been recognised by decision of the European Commission as ensuring an adequate level of protection. In cases where data recipients established in the United States of America are not included in the Data Privacy Framework list, the Company takes steps to ensure that such transfer complies with the requirements of Chapter V of the GDPR, for example, Standard Contractual Clauses are applied. These clauses are intended for the transfer of personal data from the European Economic Area to recipients established in third countries where an adequate level of personal data protection is not ensured, as described in Article 46 of the GDPR and approved in Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

If you wish to review the Standard Contractual Clauses mentioned in this section of the Privacy Policy, please contact us at the email address specified in Section 2 of this Privacy Policy.

10. Cookies

Cookies are used on our OFTET platform. A cookie is a small file consisting of letters and numbers that, with your consent, we store on your device. We use different cookies for different purposes. If you simply browse our OFTET platform, a cookie recognises your browser and visitor ID number.

10.1. Cookie management

You can choose whether to accept cookies. For the OFTET platform to function, you do not need to accept all cookies used here, but it will make browsing easier. You can delete or block all cookies except essential ones; however, if you do so, some functions of this OFTET platform may not work as intended, and you may need to reset certain settings each time you visit our OFTET platform.

You can change browser settings on your tablet or smartphone at any time so that cookies are not accepted or are deleted if cookies have already been stored. Detailed instructions depend on which browser and device you use; more information can be found here:

IMPORTANT! Please note that rejecting all cookies may have a negative impact on the use of the OFTET platform, for example, you may need to select language settings each time.

You can refuse cookies on our website homepage by changing cookie settings. It is important to remember that "essential cookies" are required for the website to function properly; these cookies cannot be disabled.

10.2. Purposes and use of cookies

We use the following types of cookies:

Strictly necessary cookies.

These cookies are necessary for our website to function. The legal basis for the use of such cookies is Article 73(4) of the Law on Electronic Communications of the Republic of Lithuania.

Functional cookies.

These cookies are used to recognise you when you return to the OFTET platform so that we can, for example, remember information relevant to you – such as language settings – and you do not need to select the language again each time. The legal basis for processing data collected by these cookies is your consent.

We provide you with a detailed and up-to-date list of cookies used:

Cookie namePurpose of data processingData usedValidity periodCookie type (essential, functional, analytical, marketing)Third-party link
sessionidSession management and authentication (API)Session ID, user identification2 weeks (or until end of session)EssentialNo
csrftokenCSRF protection against fraud (API)CSRF token1 yearEssentialNo
django_languageLanguage setting (API)Selected language (en, lt)1 yearFunctionalNo
tabstyleSwagger documentation tab setting (API)Selected tab1 yearFunctionalNo
messagesMessaging system (API)Message contentDuring sessionFunctionalNo
tokenAuthentication token (Web application)JWT access token7 daysEssentialNo
refresh-tokenAuthentication refresh token (Web application)JWT refresh token30 daysEssentialNo
AuthStoreStorage of authentication state (Web application)Authentication dataDuring sessionEssentialNo

11. Security of your personal data

Your personal data will be processed in compliance with the General Data Protection Regulation, the Law on Legal Protection of Personal Data of the Republic of Lithuania and other requirements established by legal acts. When processing your personal data, we implement organisational and technical measures that ensure protection of personal data against accidental or unlawful destruction, alteration, disclosure, as well as against any other unlawful processing.

12. Your rights

This section provides information about your rights related to our processing of your personal data and the cases in which you may exercise these rights. If you wish to obtain more information about your rights or exercise them, please contact us using the Company contacts specified in this Privacy Policy or the data protection officer's email address.

Without undue delay and no later than within 1 (one) month from receipt of the request, we will provide you with information about the actions taken upon receipt of your request regarding the exercise of your rights. Depending on the complexity of the request and the number of requests received, the specified period may be extended by a further 2 (two) months. In such a case, we will inform you within 1 (one) month from receipt of the request about such extension and its reasons. We will refuse to exercise your rights only in cases provided for by legal acts.

12.1. Right of access to your personal data

We strive for you to fully understand how we use your personal data and therefore not experience any inconvenience. You may contact us at any time and inquire whether we process any of your personal data. If we store or otherwise use your personal data, you have the right to access them. To do so, submit a written request to the email address specified in this Privacy Policy, confirm your identity (if such confirmation is required in a specific case), and when submitting such a request, adhere to the principles of fairness and reasonableness.

12.2. Right to withdraw consent

If you have provided us with explicit consent for processing of your data, you may withdraw it at any time. We explain that withdrawal of consent does not mean that the use of information about you was unlawful during the period when explicit consent was valid.

You may withdraw your consent to receive notifications by unchecking the checkbox in your personal account on the OFTET platform, in the "Notification settings" section under Settings. When you withdraw your consent, you will no longer receive notifications.

12.3. Additional rights

Below we provide information about additional rights you have, which you may exercise following the procedure described below.

a)You have the right to request that we rectify any inaccuracies in the data we hold. In such a case, we may ask you to confirm the corrected information.
b)You have the right to request that we delete your personal data. This right is exercised in the cases provided for in Article 17 of the GDPR.

At any time in the OFTET platform settings under the "Account Security" section, you may independently deactivate your account or permanently delete it. When the account is deactivated, your data will not be deleted or destroyed, but your profile will be hidden from other users of the OFTET platform and you will not receive any notifications from the OFTET platform, nor will you be able to access account information or created video and audio recordings. In this case, you will retain the ability to reactivate the account at any time and restore all its content. If you choose to delete the account, the data will be irreversibly destroyed without the possibility of restoring your data and content stored therein.

c)You have the right to request that we restrict the processing of your personal data or not process them:
  • for the period necessary for us to verify the accuracy of your personal data when you raise claims regarding data accuracy;
  • when our collection, storage or use of your personal data is unlawful, but you decide not to request deletion of the data;
  • when your personal data are no longer necessary for us, but you need them to establish, exercise or defend a legal claim;
  • for the period necessary to determine whether we have a more important legal basis to continue processing your personal data if you have exercised your right to object to the processing of personal data.
d)You have the right to data portability for data processed by automated means and which we received from you with your consent or for contract conclusion purposes. When you exercise this right, we will transfer a copy of the data you provided at your request.
e)You have the right under Article 21 of the GDPR to object to our use of your personal data. You have the right to object when your personal data are processed on the basis of legitimate interest (the legal basis on which data are processed is indicated for each of the above data processing purposes above) or for direct marketing purposes.

12.4. Right to request additional information

We hope you understand that discussing all possible ways of collecting and using personal data is very difficult. We strive to provide the clearest and most comprehensive information and undertake to update this Privacy Policy when the personal data usage process changes. Nevertheless, if you have any questions about the use of your personal data, we will be happy to answer them or provide all additional information we can disclose. If you have any specific questions or do not understand the information provided, please contact us.

12.5. Complaints

If you believe that your rights as a data subject are and/or may be infringed, please contact us immediately at the email address specified in this Privacy Policy. We ensure that upon receipt of your complaint we will contact you within a reasonable period and inform you about the progress of the complaint investigation, and later about the result.

If you are not satisfied with the investigation results, you may submit a complaint to the supervisory authority – the State Data Protection Inspectorate (www.vdai.lrv.lt), L. Sapiegos g. 17, LT-10312 Vilnius, Tel.: +370 5 271 2804 / 279 1445, Fax +370 5 261 9494, Email [email protected].

If you live or work in another European Union Member State (other than Lithuania), you have the right to submit a complaint to the State Data Protection Inspectorate through the GDPR supervisory authority in the Member State of your place of residence or work.

13. Liability

You are responsible for the confidentiality of the data you provide as well as for ensuring that the data you provide to us are accurate, correct and complete. If the data you provided change, you must inform us immediately by email. We will in no event be liable for damage incurred by you due to your providing incorrect or incomplete personal data or failing to inform us when they change.

14. Changes to the Privacy Policy

We may update or amend this Privacy Policy at any time if we deem it necessary, when information on personal data processing changes (the scope of personal data collected changes, new personal data processing purposes arise, etc.) and in other cases when it is appropriate and necessary to ensure transparency of our personal data processing; we will also update the Privacy Policy when required by the supervisory authority. We will take measures to inform you about the most important changes to the Privacy Policy on the OFTET platform; however, we recommend reviewing the Privacy Policy from time to time, as it may contain minor changes. If you wish to receive an updated Privacy Policy, please notify us at the email address specified in Section 2 of the Privacy Policy.

Last update of the Privacy Policy: 2026-04-14