Candidate privacy notice
Staffholm and Rolefit are brands of Sirin OÜ, a company registered in Estonia (registry code 16315993). Staffholm is the service employers use, and Rolefit is the name candidates see when they apply. Wherever this document says “Staffholm”, “Rolefit”, “we” or “us”, it means Sirin OÜ.
What happens to your CV
The short version. The employer receives your application. An AI model reads it for them and works out which of their jobs you fit, and a person at the employer decides what happens next.
Who holds your information
The employer you applied to decides why your application is kept and what is done with it. They are the controller. Their name is on the page where you applied. If you applied through a recruitment agency, the agency and the company it recruits for take that place.
Sirin OÜ (Estonia, registry code 16315993) runs Rolefit (rolefit.eu), the service that reads and scores your application, acting only on the employer's instructions. We are the processor.
Ask the employer first about anything to do with your application. If you write to us we will pass it to them and tell you we have.
What we collect, and why
| What | Why |
|---|---|
| The CV you upload | To work out what you have done and what you can do |
| Your answers to our questions | Because the CV did not answer them, and guessing would be worse |
| Contact details you give at the end | So the employer can reach you |
| A covering note, if you write one | To understand why you want the job |
| The pay that would motivate you, if you choose one in the advert's range | So the employer knows before the interview. It is never scored, and we never ask what you earn now or earned before. It is also counted in anonymous totals by kind of job and month, without your name, the employer's or anything else that leads back to you |
| An attachment, if you add one | Only if the employer asked for one |
| Job alerts, if you switch them on from your status page | So the employer can tell you when something new opens. One click switches them off |
| Which link brought you here, and the name of the site you came from (for example "cv.ee") | It tells the employer which advert works, and it plays no part in how your application is scored. We never record the address of the page you were on, what you searched for or anything you read |
We only ask about things the advert actually requires. You never have to give a photograph or a date of birth, and please do not include health information.
You decide what to give. Without a way to reach you the employer cannot answer you, and anything you leave out cannot count in your favour. You do not have to apply at all.
If the employer sent us your CV. Some employers forward us the CVs they receive by email or from a job portal, or add them by hand. Then the CV came to us from the employer and not from you, and the employer should have told you. Everything in this notice still applies.
What we do not do
We do not use your application to train any AI model. We do not sell it. We do not share it with other employers. We do not use it for advertising.
A person decides, not the software
An AI model reads your CV and writes the questions you are asked. It produces a ranking and a written explanation of it. It is advice.
Nobody is rejected by the software. No decision about you is made automatically. A person at the employer reads and decides, and you can ask them for a human review of any outcome, explain your side and contest it.
When a job closes, the employer can send its answer to the people still waiting through this service, in its own name. A person at the employer closes the job and chooses that answer.
There is more detail in our AI transparency notice.
The legal basis
The employer relies on their legitimate interest in filling the role, and on taking steps at your request before entering a contract, because you applied.
If you separately opt in to being kept for future roles, that part is consent, and you can withdraw it at any time without affecting the application in front of you.
How long it is kept
| Situation | Kept for |
|---|---|
| You started but never submitted | 1 day |
| You submitted | 240 days, or 180 days from the day the role is filled, whichever comes first |
| You opted in to future roles | 12 months, and you can withdraw at any time |
| You asked us to erase it | Purged within 30 days |
The reason submitted applications outlive the vacancy is that a complaint about a hiring decision can be brought after the fact, and the record is what answers it, for you as much as for the employer. If the employer exports your application, its own rules apply to that copy. After deletion the employer's statistics can still show that a job was filled, and the rank, score and channel of the person hired, without a name.
Who else sees it
The people at the employer doing the hiring. On our side, the companies listed on our sub-processors page: Supabase (database and files, EU), Cloudflare (serving the pages, receiving forwarded CVs and sending the emails you receive), Anthropic (the model that reads the CV) and Resend (a backup route for those emails, EU). If you write to us, our mailbox at Zoho (EU) holds your message. None of them may use your application to train a model or for advertising.
Some of this happens outside the EU. Anthropic reads your CV in the US, and Cloudflare is a US company whose network runs worldwide. These transfers rely on the EU's Standard Contractual Clauses, and you can ask us for a copy. Anthropic deletes what it receives within 30 days, and keeps it for longer only if it is flagged for breaking Anthropic's usage rules (up to 2 years) or the law requires it.
What you can ask for
You can ask for a copy of what is held, including in a form you can take elsewhere, correction of anything wrong, deletion, restriction, or that we stop using it, and you do not need an account to ask.
Write to the employer, or to us at privacy@rolefit.eu and we will pass it on. Requests are answered within a month.
If you are not satisfied you can complain to the Estonian Data Protection Inspectorate (aki.ee) or to the authority where you live.
Reaching us
privacy@rolefit.eu · Sirin OÜ, Nõmmiku/1, Kibuna küla, Saue vald, 76313 Harju maakond, Estonia
Last updated: 1 November 2026