Privacy Policy

When people apply to your job through our form, we email you their first name and country of residence and a link to your dashboard, at most once an hour per job or once a day as you choose; their contact details and CV are shown only after you sign in. You can stop these emails from the link in each email or in your dashboard.

After a company's first live job we ask four optional questions once: whether you sponsor work visas and for which countries, which roles you hire and roughly how many a year, and whether you would like a shortlist of candidates. We store the answers for the company with the account that answered, use them to plan candidate outreach and our services for employers (our legitimate interest, Article 6(1)(f)), show them to our team, and show the visa answer on the company page as “Employer says”. A skip is stored too, so we do not ask again. Our team receives a Telegram message summarising the answers, with the company name and no personal data.

If you tick “You may contact me about promoting our jobs”, we store that consent with its date and wording version and may contact you by email about promoting your jobs (consent, Article 6(1)(a)). Withdraw it at any time in your employer dashboard (one click, the same place you can give it) or by writing to us at the address in section 1; withdrawal does not affect earlier contact. Your answers and consents are in your data export. When you erase your account, your consents are deleted and the company's answers no longer name your account.

If you request a promotion, we store your selected jobs, company billing name and address, VAT/BIN or tax identifier, billing email, accepted promotion terms version, request status and invoice reference. We use these to review the request, arrange a manual invoice and send an expiry reminder. The operations team receives a Telegram alert containing the request identifier and status, without billing details. Your promotion requests and selected jobs are included in your data export while your account exists. When you erase your account, submitted, held and rejected requests are deleted. Orders in invoiced, paid, active, expired or ended states are retained for accounting obligations and disputes with your account link, contact email, notifications and retry identifiers removed. We keep the billing company name, address, VAT/BIN or tax identifier, invoice reference, amount, package, dates and selected jobs for the configured accounting period: by default five years from the end of the invoice’s calendar year, followed by daily deletion of expired records.

Expat Jobs is operated by DVtech (“we”), a limited liability partnership registered in Kazakhstan, BIN 260940026533, 6 Artykbay Kyrbasov Street, Zhibek Zholy, B66H0F2, Kazakhstan. Contact: office@dvtech.kz.

DVtech is the controller for account, platform and service data described here. This notice covers the website and mobile app. An employer receiving an application or CV processes the information for its own recruitment purposes and may be a separate controller with its own privacy notice.

• Account and authentication: name, email, role, password hash or social-provider identity, one-time sign-in links you request (stored only as a hash), and records of the Terms version you accepted. We use these to provide the account and requested services (GDPR Article 6(1)(b)). Passwords and authentication tokens are excluded from data exports.
• Job search and recruitment: saved jobs and searches, applications, contact and screening information, notes, CV/profile information and uploaded documents. We process information you choose to provide to deliver the requested features (Article 6(1)(b)). A submitted application is shared with the intended platform employer. Tracking an externally sourced vacancy does not automatically send an application to that employer.
• Candidate profile: your line of work, years of experience, English level and whether you need a visa, asked once when you first apply and editable in your profile. We use it to show you jobs you can move for (Article 6(1)(b)). Healthcare and care professionals can also choose to share their occupation, specialty, qualification country, target countries, registration status and English test results. We never request registration numbers. These details are self-reported professional credentials, not medical records.
• Keeping recruiter visibility current: with pool consent, we ask after 75 days whether you are still looking, by email and an app notification if enabled. Without confirmation within 14 days we hide your profile; a 90-day pause and withdrawal are available. We may ask which country you found a job in, optionally. This answer is deleted on the first daily retention run 90 days after your job-found response. Reminders can be stopped separately. Health workforce safeguards can also restrict active recruitment based on your citizenship or qualification country, including when you later change your line of work while retaining medical credentials; direct job applications remain available. These choices stay editable and are included in your data export and account deletion.
• The short step at Apply: when you press Apply on a job from another site, we may ask the questions above once before you go to the employer. Every answer is optional and the employer's site opens whether you save or skip. If you are not signed in and you save, we also keep your email address, the job and the Terms version you accepted, so you can sign in later with a link sent to that address. A new address gets a free account without a password; we do not sign you in and do not send you anything just because you saved. If the address already has an account, nothing is added to it: when its owner next signs in we show the jobs and ask whether to add them, and the answers fill the profile only if they choose so; unconfirmed answers are deleted after 30 days. We use this to keep the job in your applications and show you jobs you can move for (Article 6(1)(b)). Healthcare and care professionals can also choose to share their occupation, specialty, qualification country, target countries, registration status and English test results. We never request registration numbers. These details are self-reported professional credentials, not medical records. To prevent misuse we limit how often one network address and one email address can use this step, cap the total per day, and run an anti-abuse check (Cloudflare Turnstile) before a follow-up email can be sent.
• Follow-up emails about that job: only if you tick “Email me to ask how my application went”: about a day later we ask whether you applied, and if you did, about two weeks later whether the employer replied (once more after “No reply yet”); at most three emails about that job, described below. We store which wording you ticked; a tick under the earlier “Email me once…” wording gets only the first email. This is based on your consent (Article 6(1)(a)); it does not subscribe you to anything else. Job alerts and other emails are sent only if you ask for them separately.
• Visibility to sponsoring employers: only if you tick the separate box, and only once you have confirmed your email address (if you ticked it before signing in, it takes effect when you first open a link we sent to that address), we may show your name (if you gave one), email, candidate profile, citizenship and current country (if you gave them) to employers and recruitment agencies that sponsor visas, so they can contact you about jobs. This is based on your consent (Article 6(1)(a)); your CV is not shared without asking you. You can withdraw consent at any time in your profile, which stops new sharing.
• Job alerts by email: when you press “Email me jobs like these”, we keep the search filters, how often to email you, the page you started from and, when you unsubscribe, the time. If you are not signed in, we first store your email address, the filters and the Terms version you accepted, and send one confirmation link; nothing else is sent and no account is created unless you open it. Opening it creates a free account without a password for that address (or adds the alert to your existing account) and signs you in. We use this to send the alerts you asked for (Article 6(1)(b)). Every alert email has a one-click unsubscribe link that works without signing in. To prevent misuse we limit how many links an address, a network address and a network can be sent: network addresses are kept only in short-lived memory, and with an unconfirmed alert we store only the network it came from (the first three parts of an IPv4 address, or an IPv6 /48 prefix), never the full address (Article 6(1)(f)).
• “Did you apply?” email: only if you tick the box when you press Apply and go to an employer's site, we email you about a day after you left for that site to ask whether you applied. Jobs that are due at the same time come in one email, and we leave at least 23 hours between two such emails. We keep whether you asked for it and when, when we sent it, and your answer and its time with the application. A “Yes” marks the job as applied in your tracker, and it stays applied if you later answer otherwise. The answer buttons work without signing in; answering “Yes” or “Not yet” from the email also confirms that the address is yours. If you gave your address without an account and someone else typed it, “This wasn't me” in the email deletes the applications saved under it and stops these emails. Every such email has a one-click “Stop these emails” link (and the unsubscribe button of your mail app), which stops them for all your applications until you tick the box at Apply again; job alerts are separate. We use this to provide the reminder you asked for (Article 6(1)(b)) and, as counts that identify nobody, to report how many people apply through Expat Jobs (Article 6(1)(f)).
• “Got a reply?” email: for jobs ticked under the current wording, once you tell us you applied (in the “Did you apply?” email or in your tracker), we email you about two weeks later to ask how it went: Interview, Offer, Rejected or No reply yet. If you answer “No reply yet”, we ask once more about two weeks after that, and never again: at most two such emails per job, and at least 23 hours between any two follow-up emails to you. We only send it to a confirmed address. We keep with the application when you told us you applied, when we sent each email, and your latest answer and its time; Interview, Offer or Rejected also update the job in your tracker (it only moves forward). The answer buttons work without signing in and change nothing until you confirm on the page. The same “Stop these emails” link and mail-app unsubscribe stop both follow-up emails for all your applications. We use this to provide the check-in you asked for when you ticked the box (Article 6(1)(a)). We also count the answers per employer, never with your name or any other detail about you, to learn and show other candidates which employers reply to people from abroad (our legitimate interest, Article 6(1)(f)); an employer's figure is shown only once at least 10 people have answered about it. Your answers are in your data export and are deleted with the job from your tracker or with your account.
• Optional integrations and tools: social sign-in and a previously linked Telegram account. These run when you select the feature.
• AI features: currently not offered. If we offer CV parsing or tailoring, a cover letter draft or interview preparation, the relevant input you submit for that request may be sent to our configured AI provider, OpenAI. These suggestions do not make an employer's hiring decision.
• Premium billing: plan, subscription status, order and transaction identifiers and the country used for tax. We use these to grant and manage Premium (Article 6(1)(b)) and keep transaction records required by tax and accounting law (Article 6(1)(c)). Card details are entered with Paddle and are not stored by us.
• Service and security: device push tokens, request/security records and limited technical identifiers, used to deliver requested notifications and protect the service (Article 6(1)(b) where necessary for a requested feature; Article 6(1)(f) for proportionate security and abuse prevention). We assess legitimate interests against users' rights.

Employer accounts: the new-applicant email, the optional employer questionnaire and the business-contact consent are described in Employer accounts above.

Providing account details is necessary to create an account. Optional profile fields, CV uploads, integrations and notification settings are your choice. Do not send unnecessary sensitive information in CVs or applications. If processing requires consent, we ask separately for that purpose; accepting Terms or reading this notice is not a blanket data-processing consent.

• The intended platform employer receives the application information you submit to it. If you consent to visibility, employers and recruitment agencies that sponsor visas may receive the profile details described above; they process them under their own privacy notices.
• Our hosting/storage providers in Kazakhstan operate the server and file storage. Resend delivers service emails; Cloudflare Turnstile processes anti-abuse checks.
• Google, Apple or Telegram process sign-in when selected. Expo and platform push providers (including Firebase/Google on Android) deliver notifications. A linked Telegram account receives the job alerts you set up.
• Our configured AI provider, OpenAI, receives relevant input for AI features you request, when they are offered. DeepL is retained for vacancy-description translation; its user-facing translation control is currently disabled.
• When you buy Premium, Paddle.com acts as Merchant of Record and processes your payment, billing address and tax details under its own privacy notice. We receive your account email, plan, order and subscription status, but never your full card details.
• Employer questionnaire: our team sees the answers and the account that gave them, and receives a Telegram summary with the company name and answers only. The visa answer is public on the company page (“Employer says”); nothing else from it is published.
• Authorities or other recipients may receive limited information if required by applicable law. We do not sell personal data.

Server-side data and uploaded files are hosted in Kazakhstan, outside the EEA. Provider locations may differ for email, authentication, AI and notification services. Transfers to another organisation outside the EEA that fall under GDPR Chapter V require an applicable transfer mechanism and, where necessary, supplementary safeguards. Kazakhstan does not have an EU adequacy decision.

Contact expatjobs@dvtech.kz for the recipient locations, contractual safeguards and how to obtain a copy of safeguards applicable to your data. This notice does not itself create transfer safeguards or override your GDPR rights.

We use HTTPS/TLS, hashed passwords, restricted access and checks that limit applications and exports to authorised accounts.

• Visibility consent: we keep a record of each time you gave or withdrew it, with the wording you saw and whether it was on the website or in the app, until you delete your account. The same applies to the follow-up email choice made at Apply. Your “Got a reply?” answers are kept with the job in your tracker until you delete it or your account.
• Answers waiting for an existing account: answers given at Apply for an address that already has an account are deleted after 30 days if its owner has not confirmed them by then. An account created at Apply that nobody ever signs in to (the address is never confirmed) is deleted after 180 days, with its answers and applications. Counts of how often the step was shown, saved or skipped are kept without any identifier.
• Unconfirmed job alerts and sign-in links: a confirmation link expires after 48 hours and a sign-in link after 30 minutes; both records, including the email address of an alert that was never confirmed, are deleted a week after they expire.
• Employer questionnaire: the answers are company information, kept while the company recruits through Expat Jobs or until the company asks us to delete them; erasing the account that answered removes its link to them. A business-contact consent is kept until you withdraw it or delete your account, then deleted.
• Account and requested service records: while needed to provide your account and the features you maintain, or until you delete the relevant record or account. We review continued necessity, including inactive accounts.
• Account deletion: platform account data and dependent database records are erased. CV files, previous file versions and abandoned uploads are queued for erasure after existing upload links expire; failures remain queued for retry. Limited erasure identifiers are retained to prevent deleted accounts reappearing after a backup restore. Completed identifiers are reviewed for removal within 90 days once older recovery copies and outstanding deletion tasks are resolved; any necessary exception is documented.
• Recovery copies: the configured local backup cycle is seven days. Deleted information may remain in restricted recovery copies until they expire. The erasure journal must be applied before a restored system serves users. Copies you or other recipients keep outside our systems are not erased by deleting your Expat Jobs account.
• Limited records may need separate treatment for a legal obligation or a specific legal claim. We assess this individually, explain applicable exceptions and avoid retaining unrelated information. Provider-held delivery/security records are subject to applicable provider arrangements and rights-request handling.

Depending on the processing and applicable law, you may request access and a copy, correction, erasure, restriction, objection, and portability. You may withdraw consent for any processing based on consent without affecting earlier lawful processing. You can disable notifications or disconnect integrations in settings.

Use Manage my data to export your platform records and files or request permanent account deletion. Contact expatjobs@dvtech.kz for other requests, disabled accounts, unavailable file copies or restrictions. We may need proportionate identity verification. We normally respond within one month; any lawful extension or refusal will be explained within that period.

You may lodge a complaint with the competent data-protection authority, including the authority where you live or work in the EEA. We do not waive these rights through our Terms.

We use authentication and preference storage needed for sign-in, appearance and selected features. The mobile app stores credentials in the operating system's secure storage and may cache jobs or local activity. Temporary exports in the app cache are cleared on next use after 24 hours or when you delete the account; copies you save elsewhere remain under your control. Deleting an account also clears its local app/browser state on that device.

With your consent we record how the website and app are used (for example page views, searches with their filters, job views, saves and sign-up steps) to improve the service and to show employers how their own job posts perform. Analytics run on our own servers; no third-party analytics or advertising service receives them. Each browser or app install gets a random identifier, and events are linked to your account while you are signed in. We do not store your IP address with events, and email addresses or phone numbers typed into search are masked before storage.

Nothing is recorded until you choose "Allow analytics", and you can withdraw at any time here or in the app's Privacy screen; withdrawing deletes the identifier and any unsent events on that device. Separately, as part of operating the job board, we count job page views and clicks through to an original posting per job, without any identifier, cookie or stored IP address. Raw analytics events are deleted after 180 days; daily per-job totals (views, apply clicks, saves) contain no personal data and may be kept longer. Your data export includes analytics events linked to your account, and deleting your account deletes them together with events from the browsers and app installs you used while signed in.

We identify versions and inform users of material changes. If a new purpose requires consent or renewed Terms acceptance, we ask explicitly. Continuing to use the service does not automatically provide consent to unrelated processing.