Privacy Policy

This has not been reviewed by a lawyer. It is written against the code that implements it, so every retention period and every processor named below is the one the software actually honours, not a template clause.

01Who is responsible

The controller of your personal data is the single-operator business, established in the European Union, that operates Top Roles.

For anything about your data, write to privacy@toproles.eu. We are a small operation and we are not required to appoint a data protection officer, so that address reaches a person rather than a department.

02The short version

We sell a subscription, not your attention. There is no advertising on this site, no advertising network, no analytics product, no tracking pixel, and nothing here is sold or shared with a data broker.

If you have never signed in, we hold no name, no email address and no account for you. What we hold is a log of pageviews used to count visitors, keyed by a hash that is thrown away and regenerated every day. See section 7.

If you have signed in, we hold what your provider told us and what you have done on the site: the roles you saved, the terms you watch, the employers you follow, and the postings you opened. All of it exists to make the board and your alerts work, and all of it can be deleted on request.

03What we collect

If you only browse

Pageviews: The path you asked for, the referrer, your user agent, the country your address resolves to, and your IP address.
Visits: Consecutive requests from the same daily visitor key, stitched into a visit, with the searches typed, the filters applied, and the roles opened during it.
Job opens: Which posting was opened, and whether the press was a read or a click through to the employer’s application form.

Your IP address is used to derive a country and to build the daily visitor key, and is then removed from the log on the schedule in section 9. The country derivation is done on our own server against an offline table, no lookup service sees your address.

If you sign in

We do not operate passwords. You sign in with Google or GitHub, and they tell us what you release to them:

Identity: Your name, email address, profile picture, and the provider’s own identifier for you. The identifier is what we key your account on, not the email address.
Sessions: A random token, of which we store only a SHA-256 hash, with the time it expires, the user agent, the IP address and the country it was created from.
Where from: The address and country your account was opened from, kept once, and the ones you most recently signed in from, which move on each login. Both exist so a sign-in from an unexpected place is visible.
What you keep: Saved roles, tracked terms, followed employers, company suggestions, and reports you file about a posting.
What you opened: The postings you opened while signed in, when, how many times, and whether you went through to apply.
Mail: Your alert frequency, when you were last sent one, the last role it carried, and a log line per send recording how many roles it contained and whether delivery succeeded. We do not track opens and we put no tracking pixel in the mail.

If you buy a plan

Payment is handled entirely by Stripe on their own pages. We never receive or store your card number. What we store is Stripe’s customer and subscription identifiers, the status of the subscription, and the date the current term ends, which is what tells the site whether your account is Pro.

What we do not collect

We do not ask for and do not want a CV, a date of birth, a postal address, a phone number, a nationality, a photograph you upload, or anything about your health, beliefs, ethnicity, sexuality or trade union membership. Please do not send any of it through the report or suggestion forms.

04Why, and on what basis

Article 6 requires a lawful basis for each purpose. Ours are these, and nothing else:

Contract · 6(1)(b): Running your account, keeping your saved roles and watched terms, sending the alerts you asked for, and taking payment for a plan. Without this data the service you signed up for cannot be provided.
Legitimate interests · 6(1)(f): Counting visitors, understanding which searches and filters are used, protecting the service against abuse and automated bulk access, and keeping a short security log of where accounts sign in from. Our interest is in running and defending a service people pay for; the data is minimal, aggregated for almost every use, and none of it is used to make a decision about you.
Legal obligation · 6(1)(c): Keeping records of the payments we take, for as long as tax and accounting law requires.
Consent · 6(1)(a): Only if we ever send you something that is not the alert you signed up for. We do not do this today, and if we start it will be a separate opt-in you can withdraw at any time without affecting anything else.

You may object at any time to anything we do on the basis of legitimate interests. See section 10.

There is no automated decision-making with legal or similarly significant effects, and no profiling in that sense. The matching that decides which roles reach you is a filter you configured, and you can see and change every part of it on your account.

05Email alerts

An account receives an alert only when it is watching something, at least one tracked term or one followed employer. The mail carries the roles that matched since the last one, and nothing else. There is no tracking pixel in it and we do not record whether you opened it.

You can switch alerts off entirely, or change their frequency, in the Alerts section of your account. Every message also carries a List-Unsubscribe header, which is the unsubscribe button your mail client shows at the top of the message.

07Cookies and how we count visitors

This site sets no advertising or analytics cookie, and there is no consent banner, because there is nothing here to consent to. Two cookies exist and both are strictly necessary:

nlj_session: Holds your session token so you stay signed in. Set only after you sign in, expires after 30 days, and is deleted when you sign out.
nlj_oauth: Holds a random value for the few seconds a sign-in is in progress, to prove the reply came back from the same browser that started it. Discarded immediately afterwards.

Your choice of light or dark theme is stored in your browser’s own local storage under nlj-theme. It never reaches our server.

The visitor count

To know how many people visit, we need to tell one visitor from another without identifying either. Instead of a cookie, each pageview is keyed by a SHA-256 hash of a secret salt, today’s date, your IP address and your user agent. Because the date is part of it, the key changes at midnight and the same browser cannot be followed from one day to the next. It is not reversible, and it is not used to build a profile. Only to count.

08Transfers outside the EEA

The server and the database are in the EEA. The processors in section 6 are US companies, so some data reaches the United States: your identity from the sign-in provider, your email address and payment details at Stripe, and your email address and the alerts themselves at the mail provider.

Those transfers rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and on the Commission’s standard contractual clauses otherwise, as noted against each processor above. You can ask us for a copy of the safeguards that apply.

09How long we keep it

These are the periods the software actually enforces, not intentions:

IP addresses in the log: Scrubbed after 30 days. The row survives with its country and its counts; the address does not.
Pageviews and visits: Deleted after 180 days.
Sessions: Expire after 30 days and are swept from the database once expired, or immediately when you sign out.
Your account and its contents: Kept while the account exists. Saved roles, watched terms, follows, opens and reports are what the account is for, so they last as long as it does.
After you close your account: Deleted within 30 days, along with everything attached to it.
Payment records: Kept for as long as tax and accounting law requires. Generally 7 to 10 years depending on the member state, and for nothing else. Stripe keeps its own records under its own policy.
Job postings: Kept indefinitely. A posting is a company’s public statement about a vacancy, it is not personal data about you, and the history of when roles opened and closed is the substance of what this site knows.

10Your rights

Under the GDPR you can require us to do all of the following, free of charge:

Access, a copy of the personal data we hold about you, and the information in this policy applied to your own record. Article 15.
Rectification. Correct anything inaccurate or complete anything missing. Article 16.
Erasure. Delete it. This closes your account, since almost everything we hold about you exists to run it. Article 17.
Restriction. Stop us using it while a dispute about it is resolved. Article 18.
Portability. Receive what you gave us in a machine-readable form, or have it sent directly to another controller. Article 20.
Objection. Object to anything we do on the basis of legitimate interests, including the visit log. We stop unless we can show compelling grounds that override your interests. Article 21.
Withdraw consent. Where we ever rely on it, at any time, with no effect on what was done before. Article 7(3).

Write to privacy@toproles.eu. We answer within one month, and will say so if a request is complex enough to need the two-month extension the regulation allows. We may ask you to confirm you control the email address on the account, which is the only identity check we can do without collecting more data than we hold.

Much of this you can also do yourself, immediately, on your account: remove a saved role, stop watching a term, unfollow an employer, withdraw a report, or switch alerts off.

11Security

The site is served over TLS. We store no passwords, because we issue none. Session tokens are stored only as hashes, so a copy of the database is a list of hashes rather than a set of working logins. Card numbers never reach our server. Access to the server and the database is limited to the operator, over key-based authentication.

No service is perfectly secure. If we suffer a breach that is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours as Article 33 requires, and tell you directly where Article 34 requires it.

If you find a vulnerability, please tell us at support@toproles.eu before disclosing it.

12Children

This is a service for people looking for professional work and it is not directed at children. You must be at least 16 to hold an account. If we learn we hold data about someone under 16, we delete it.

13Changes to this policy

We update this policy when what we do changes. The date at the top says when it last did. If a change materially affects how we use your data and you have an account, we will email you before it takes effect.

14Contact and complaints

Top Roles
privacy@toproles.eu

If you think we have handled your data wrongly, please tell us first. We would rather fix it. You also have the right to complain to a data protection supervisory authority, either in the EU member state where we are established or in the EU country where you live or work. The list of authorities is published by the European Data Protection Board.