Outsorcy ("Outsorcy", "we", "us", or "our") operates https://outsorcy.com (the "Site") and provides business services including a global talent and outsourcing platform and related services (collectively, the "Services"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information, and explains your rights.
By using or accessing the Services you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree, please do not use the Services.
We collect information you provide directly when you engage with our Services, including:
When you interact with our Site and Services we automatically collect:
We may obtain information from:
We use personal information to:
Legal bases (EU/GDPR): Where GDPR applies, we rely on one or more of:
Outsorcy is a recruitment agency. If you apply for a role on our careers page, or send us your CV for future roles, this section describes what happens to your details. It applies alongside the rest of this policy.
What we collect: your name, email address, the country you live in, your CV (as a PDF), and anything you choose to tell us in the message field. Phone number and LinkedIn profile are optional. When you apply we also record the version of the privacy notice shown to you and whether you ticked the box asking us to keep your CV for future roles.
Why we use it: only to match you with roles at companies Outsorcy recruits for, and to contact you about those roles. We will not send your CV to any company without asking you first. The company you would work for is named to you before anything is shared with it.
Legal basis: taking steps at your request before entering into a contract, for the role you applied to; and your consent, where you ask us to keep your CV for future roles. You can withdraw that consent at any time by emailing [email protected].
How long we keep it: we keep CVs for 24 months from our last contact with you, and then delete them.
Where it goes: your application is sent from this website directly to our recruitment platform at talent.outsorcy.com. Nothing you submit is stored on this website. The platform runs on DigitalOcean in Frankfurt, Germany, and its backups stay in the same region. CV files are stored with Cloudflare R2 under EU jurisdiction. The confirmation email you receive is sent through Resend. Our recruiters work from Google Workspace, so anything you email to [email protected], and our correspondence with you, is held there, and recruiters' Google Drive may hold a copy of your CV. If you are invited to a one-way video interview, your name and email address are shared with Hireflix, S.L. (Barcelona, Spain), which hosts the interview and stores the recording. Hireflix is based in the EU; where it uses providers outside the EEA it states that it applies appropriate safeguards.
Transfers outside the EU and Kosovo: Google, DigitalOcean and Resend are certified under the EU-US Data Privacy Framework. Anthropic is not; transfers to it rest on the EU Standard Contractual Clauses. Cloudflare Turnstile runs on Cloudflare's global network.
Automated processing: every application is read by a recruiter and every decision about your application is made by a person. Our recruiters may use AI tools, through the Anthropic API, to help summarise or assess a CV, but only after a recruiter has chosen to open it, and no decision is made solely by automated means. The form uses an automated bot check; a submission that fails it is refused and you are asked to try again.
Bot check: the application form and our other forms use Cloudflare Turnstile to tell people from automated traffic. Cloudflare processes your request, including your IP address and browser details, for that purpose only.
Your rights: to ask what we hold about you, to correct it, or to have it deleted, email [email protected]. Your other rights under "Your rights and choices" below apply as well. Kosovo's Law on Protection of Personal Data, and the GDPR where it applies, are the standards we work to.
We use cookies and similar technologies to operate the Site, analyze use, and deliver personalized content and advertising. Cookies generally fall into these categories:
You can manage cookie preferences via our cookie banner and your browser settings. Blocking cookies may reduce functionality.
When you submit a form on the Site and have accepted marketing cookies, we record basic marketing-attribution details about how you reached us: the campaign tags (UTM parameters) on the link you arrived from, the website that referred you, the page you first landed on, and the pages you viewed during that visit. We attach them to your enquiry in our CRM. We use this only to understand which of our marketing efforts are effective. It runs on the basis of our legitimate interest in measuring our marketing and only when you have consented to marketing cookies; you can withdraw that consent at any time via our cookie banner.
Some advertising measurement also happens server to server with platforms such as Meta and LinkedIn (for example, to record that an ad led to an enquiry), rather than through cookies in your browser. Because it does not use browser cookies, it is not switched off by the cookie banner; we rely on our legitimate interest in measuring our advertising, and we hash the contact details we send (convert them to a non-readable form) wherever possible. See "Opt-outs and marketing preferences" below for ways to limit advertising.
We may share personal information:
We require vendors to maintain confidentiality and security. Any transfers will be subject to appropriate safeguards (e.g., standard contractual clauses).
California / "Sale" or "Sharing": To the extent applicable law defines "sell" or "share," Outsorcy does not "sell" or "share" personal information for money.
If you are located outside the country where the data is processed, your information may be transferred to and processed in other jurisdictions. We use contractual protections and other safeguards (such as EU Standard Contractual Clauses) to protect transferred data. Contact us for details about transfer mechanisms.
We retain personal information only as long as necessary for the purposes described, and as required by law. Typical retention periods:
We securely delete or anonymize information when no longer needed.
We implement reasonable technical and organizational measures to protect your personal information, including encryption in transit (TLS), access controls and RBAC, logging, regular security reviews and employee training. No system is perfectly secure; if a security incident affects your personal data we will take reasonable steps and notify you where required by law.
Our Services are not directed to children. We do not knowingly collect personal information from children under the age of 16. If we learn that a child under the applicable age has provided us personal info, we will delete it. Parents or guardians may contact us at [email protected] to request deletion.
You may have the right to: access, correct, delete, restrict processing, object to processing, obtain a portable copy, withdraw consent, and lodge a complaint with a supervisory authority. We will verify identity before responding.
Timeframe: We aim to respond to GDPR requests within one month (30 days). Complex requests may warrant an extension, but we will notify you.
California residents have the right to request: categories of personal information collected, categories of sources, categories of recipients, business purpose for processing, access to specific pieces of personal data, deletion, opt-out of sale or sharing, and to not be discriminated against for exercising these rights.
Timeframe: We respond to verifiable CCPA requests within 45 days or as required by law.
To exercise your rights, contact us at:
Email: [email protected]
Mail: Ukshin Hoti Street, Prishtina 10000
If your request concerns a job application or a CV you sent us, you can also write to [email protected], which reaches our recruiters directly.
We may require additional information to verify identity. You may designate an authorized agent to exercise rights on your behalf.
Global Privacy Control (GPC): If your browser or device sends a GPC signal, we will treat it as an opt-out request where applicable.
You may opt out of receiving promotional communications by following unsubscribe links in marketing emails or by emailing [email protected] with the subject "UNSUBSCRIBE". Even if you opt out of marketing, we may still send you transactional or account-related messages.
For advertising opt-outs (e.g., cookie-based advertising), use the cookie banner or vendor opt-outs (Google Ad Settings, opt-out cookies for ad providers), or the Global Privacy Control where applicable.
Our Services may include links to third-party websites. We are not responsible for the privacy practices of those sites. Review external sites' privacy policies before providing information.
We may update this Privacy Policy to reflect changes in practices or legal requirements. We will post the revised policy on our Site and update the "Last updated" date. For material changes, we will provide notice (e.g., email or Site banner) as required by law.
Data controller / contact: Outsorcy
Privacy contact / DPO: [email protected]
Address: Ukshin Hoti Street, Prishtina 10000
For EU users: you may also lodge complaints with your supervisory authority.