Privacy policy
Staffholm and Rolefit are brands of Sirin OÜ, a company registered in Estonia (registry code 16315993). Staffholm is the service employers use, and Rolefit is the name candidates see when they apply. Wherever this document says “Staffholm”, “Rolefit”, “we” or “us”, it means Sirin OÜ.
Who we are
Sirin OÜ, the company that makes Staffholm, registry code 16315993, Nõmmiku/1, Kibuna küla, Saue vald, 76313 Harju maakond, Estonia. Contact: privacy@staffholm.com.
Who this covers
- Visitors to staffholm.com, app.staffholm.com and rolefit.eu
- People who open or use an account: owners, admins, recruiters, hiring managers and viewers
- People who contact us
- People who answer one of our adverts on Facebook or Instagram by filling in its form
- People at companies we contact about their hiring, by email, phone, LinkedIn or in person
What we collect
| What | Why | Basis |
|---|---|---|
| Work email address, password (hashed) | To give you an account | Contract |
| Company name, web address, strapline | To run your workspace and careers page | Contract |
| The country your company is registered in, its registration number, and the domain of your email address | To give one free trial and one Free plan per company | Legitimate interest |
| Billing contact, company details, VAT number | To invoice you | Contract, legal obligation |
| Usage, meaning applications processed, roles open and when you signed in | To enforce plan limits and bill correctly | Contract, legitimate interest |
| Where you heard about us, if you tell us, and the link that brought you to sign up | To know which channels work | Legitimate interest |
| Support correspondence | To answer you | Legitimate interest |
| Your name, company, phone number, email and the answers you give in the form of one of our Facebook or Instagram adverts | To ring or write you back about Staffholm, as the form asks | Steps you asked for before a contract |
| Server logs, including IP address | Security and abuse prevention | Legitimate interest |
| Page views on staffholm.com and the example careers pages, counted without a cookie or an IP address. Only the page, the name of the site that linked to it, and whether it was a person or a search engine's crawler | To know whether people find us | Legitimate interest |
You need an email address and a password to have an account, and billing details to buy a plan. Everything else is optional or follows from using the service. We make no automated decisions about account holders.
We do not run advertising trackers or analytics that profile you. See the cookie policy.
Business contacts we approach
When we contact a company about its hiring, by email, phone, LinkedIn or in person, we use details that the company or the person published themselves, on a website, in a business register, in a job advert, on a professional profile or in public news about the company, or that someone who knows the company passed to us. We keep the person's name, work email address, work phone number, company, role, the advert we wrote about and what was said. We use them only to offer Staffholm to people who hire. Our basis is legitimate interest.
You can object at any time, free of charge and without giving a reason. Say no in any of those ways, or write to privacy@staffholm.com, and we stop at once. We then keep only the address on a do-not-contact list, so that nobody at Staffholm contacts it again. If nobody replies, we delete the person's name and contact details 12 months after our last contact and keep only the company's name, so that we don't contact the same company twice.
What we never do
We do not sell your data. We do not share it with advertisers. We do not use your data, or any candidate's, to train AI models.
Payment
Payments are handled by Stripe. Card details go to Stripe directly and never reach us. We hold what Stripe tells us, which is your customer id, subscription status, plan and the billing details you gave.
How long we keep it
| What | Kept for |
|---|---|
| Account, while it is open | Until you ask us to close it |
| Account, after closure | 90 days, then deleted |
| Invoices and accounting records | 7 years, as the Estonian Accounting Act requires |
| Server logs | Up to 30 days |
| Page view counts | 90 days |
| Support correspondence | 2 years |
| Answers to an advert's form, if you do not become a customer | 12 months |
| The name and contact details of a business contact we approached, if nobody replies | 12 months after our last contact |
| An address that asked us to stop | Kept on the do-not-contact list, so we never contact it again |
Candidate data in your workspace follows the periods in the candidate privacy notice, not this table.
Who else sees it
Supabase (accounts and database, EU), Cloudflare (serving the site and routing mail to our addresses), Resend (email we send you, EU), Zoho (our own mailbox, EU), Anthropic (the AI model that drafts adverts and reads CVs for you) and Stripe (payments, Ireland). When we message you on LinkedIn, LinkedIn handles that message under its own privacy policy. When you fill in a form in one of our Facebook or Instagram adverts, Meta Platforms Ireland receives it first, under its own privacy policy, and passes it to us. We place no Meta tracking code on our sites. Full details on the sub-processors page.
Some are US companies. Transfers rely on the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. You can ask us for a copy at privacy@staffholm.com.
Your rights
Access, correction, erasure, restriction, portability, and objection to processing based on legitimate interest. Write to privacy@staffholm.com and we will answer within a month.
You can complain to the Estonian Data Protection Inspectorate (aki.ee) or the authority where you live.
Changes
We will tell account owners by email before a material change takes effect.
Last updated: 1 November 2026