Privacy Policy
Organic Growth Recruiting (OGR) · Last updated: 27 August 2026 · Version 2.0
1. Who is responsible for your personal data
Organic Growth Recruiting (OGR), company registration number 559577-2889, is the data controller for the personal data described in this policy.
Data protection contact: getthebest@ogr.nu
Postal address: [fill in street address, postcode and city]
We have not appointed a data protection officer, as our operations are not subject to that requirement.
2. When we process your personal data
We process personal data when you:
- visit our website
- apply for a role via our form
- contact us with a question or client assignment
- are contacted by us during a search or candidate sourcing process
3. What data we collect
From you as a candidate: name, email address, phone number, LinkedIn profile link, current role and employer, areas of interest, your message to us, CV and other attachments, the role you applied for, and the timestamp of your application.
From you as a client or enquirer: name, email address, phone number, company, role, and the content of your request.
Automatically when you visit the website: IP address, device and browser type, which pages you visit, how you arrived at the website, and timestamp. See section 6 on cookies.
From other sources during search: see section 5.
4. Why we process the data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Assess your application, communicate with you during the process and present you to the client | Legitimate interest – to carry out the recruitment process you initiated |
| Identify and contact potential candidates (search and sourcing) | Legitimate interest – to operate a recruitment business and match the right person with the right role |
| Store your data in our candidate pool after the process ends, for future roles | Your consent |
| Respond to and manage client enquiries | Legitimate interest – to manage our business relationship |
| Run the website securely and stably (necessary cookies) | Legitimate interest – to keep the website functioning |
| Web analytics via Google Analytics | Your consent via the cookie banner |
| Be able to meet legal claims, for example under the Discrimination Act | Legitimate interest – to defend ourselves legally |
If you do not provide the data: You do not need to provide any data to us. However, without your name, contact details and background information we cannot process an application or present you to a client.
5. Data we obtain from other sources
In search and sourcing assignments, we collect data from open sources, primarily LinkedIn, company websites, industry registers and public records. The data we collect is usually name, current role and employer, professional background, and professional contact details.
If we process your data in this way, we will inform you no later than when we first contact you, and always within one month. You may ask us to delete the data or object to the processing at any time – see section 11.
6. Cookies and web analytics
We use necessary cookies for the website to function. These do not require consent.
We also use Google Analytics to understand how the website is used and to improve it. Google Analytics sets cookies and processes your IP address, among other things. We only activate this once you have consented via our cookie banner, and you can change or withdraw your choice at any time there.
The provider is Google Ireland Limited. Read more about how Google processes data at policies.google.com/privacy.
7. Who we share data with
We never sell personal data. We share it with:
- The client commissioning a recruitment process. We only present you after you have been told which client it concerns. The client is then independently responsible for its own further processing, and its privacy policy applies.
- Providers of candidate and contact management systems that store data on our behalf.
- Providers of email, hosting and web analytics.
- Authorities, if we are required by law.
All providers process the data as data processors for us, under written data processing agreements, and may only use the data to deliver their service to us.
8. Transfers outside the EU/EEA
Some of our providers may process data in countries outside the EU/EEA, mainly the USA. When this happens, we ensure the transfer is protected either by the EU Commission's standard contractual clauses (SCC) or because the recipient is certified under the EU–US Data Privacy Framework.
If you would like to know which providers this concerns and receive a copy of the safeguards, please contact getthebest@ogr.nu.
9. How long we keep the data
| Situation | Retention period |
|---|---|
| Application for a specific role | During the process and then 24 months, to be able to meet any claims under the Discrimination Act |
| Candidate pool for future roles | 24 months from your last activity. We then delete the data or ask you for renewed consent |
| Search data where you did not progress | Deleted when the assignment ends, unless you have consented to the candidate pool |
| Client enquiries and business contacts | 24 months from last contact |
| Web analytics data | Up to 14 months |
You can always ask us to delete your data earlier. We then delete everything except what we are legally obliged to keep.
10. Security
Data is stored in systems with access control, and only employees who need the data for their work have access. Transfers are encrypted, and we have procedures to detect and handle personal data incidents.
11. Your rights
You have the right to:
- access the data we process about you
- have inaccurate data corrected
- have data erased
- request that processing be restricted
- object to processing based on legitimate interest, including search
- receive your data in a machine-readable format (data portability), to the extent the processing is based on your consent and is automated
- withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing that took place before the withdrawal
Contact us at getthebest@ogr.nu and we will normally respond within one month.
12. Automated decision-making
We do not use automated decision-making or profiling that filters out candidates. All assessment is done by a human.
13. Sensitive personal data
Please do not send us information about health, ethnic origin, religion, trade union membership, political opinions, sexual orientation, or criminal convictions – whether in your CV, cover letter, or free-text fields. We never request such information, and it is not needed for our assessment.
14. Complaints
If you believe we are processing your personal data incorrectly, please contact us first. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.
15. Changes to this policy
We may update this policy. The current version and the date of the latest update are always shown at the top of this page. For material changes, we will inform you if you are in our candidate pool by email.