1. Who we are (controller)
Corvana is a business name used by Yehuda Cohen, who is the controller responsible for the processing described in this notice. Contact: yehuda@corvanagroup.com. This notice explains how Corvana (“we”, “us”) processes personal data in connection with its business-to-business recruitment-coordination activities.
Email for all privacy matters: yehuda@corvanagroup.com.
2. What business data we may process
- Name and job title
- Business email address and business telephone number
- Company name and role within the company
- Publicly available information about your organisation’s hiring needs, such as published job advertisements
- Our correspondence with you, including any request not to be contacted
3. Where we get it (GDPR Article 14)
For business-to-business outreach, we do not obtain your personal data from you. We obtain it from publicly accessible sources: employer websites and careers pages; public job advertisements and job boards (such as posao.hr, the Croatian Employment Service seasonal portal and MojPosao); public business registers and business directories; and public professional profiles and networks (such as LinkedIn). We also process information you send us directly.
For outreach, we use only contact details that an organisation publishes for that purpose, such as its recruitment, HR or general business inbox. We do not guess or construct email addresses.
Because this data is not collected from you, GDPR Article 14 applies. This notice gives the information Article 14 requires: who the controller is (section 1), the categories of data (section 2), the sources and whether they are publicly accessible (this section), the purposes and legal basis (sections 4 and 5), recipients (section 9), international transfers (section 10), retention (section 8), your rights, including the right to object (sections 6, 7 and 11), and the right to complain (section 12).
We provide this information at the latest at the time of our first communication with you: every outreach message we send contains a link to this notice (https://www.corvanagroup.com/privacy).
4. Why we use it
- To contact organisations, on a business-to-business basis, about their recruitment needs and how we may be able to help
- To respond to enquiries
- To manage business relationships and related correspondence
- To keep a suppression record, so that we respect requests not to be contacted
5. Legal basis
We rely on our legitimate interests (GDPR Article 6(1)(f)) in developing business relationships with employers and in carrying out relevant, limited business outreach. This also covers the business contact details of people who work for an organisation we contact or do business with, including where we have a contract with that organisation. We have documented an internal assessment balancing these interests against your rights; a summary is available on request.
We rely on Article 6(1)(b) only where you yourself are a party to a contract with us, or where you ask us to take steps before entering into such a contract.
We keep suppression records in order to give effect to objections (Articles 6(1)(c) and 6(1)(f)).
Where national electronic-communications rules require consent for a particular form of contact, we follow those rules.
6. Your right to object to direct marketing
You can object at any time to the use of your personal data for direct marketing, and we will stop (GDPR Article 21(2)–(3)). You can also object to other processing based on legitimate interests, on grounds relating to your particular situation (Article 21(1)).
7. Opting out and suppression
Reply “no” to any of our messages, or email yehuda@corvanagroup.com, and we will not contact you again. To make sure of that, we keep a minimal suppression record, separate from our contact lists: the email address or domain, the date and the reason. We use it only to prevent further contact.
8. How long we keep it
We keep business contact data for organisations with which no active business relationship has developed for 12 months from our last meaningful outreach or activity. After that, it is deleted or anonymised, unless another legitimate business need exists. If a business relationship develops, we keep data for as long as the relationship lasts, plus any period required by law. Suppression records are kept separately, and only for as long as needed to honour your request not to be contacted.
9. Who receives it
Our service providers (processors), who act on our instructions under data processing terms: our email and productivity provider (Google Workspace) and our website hosting provider (Cloudflare, through Cloudflare Pages). Where relevant to a specific vacancy, we share data with licensed recruitment partners. We do not sell personal data.
10. International transfers
Some service providers or partners may process data outside the European Economic Area. Where this happens, we rely on appropriate safeguards, such as an adequacy decision or the European Commission’s Standard Contractual Clauses. A copy is available on request.
11. Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection. To exercise any of these rights, email yehuda@corvanagroup.com. We will respond within one month.
12. Complaints
You can lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work, or where the alleged infringement took place. Examples include, in Croatia, the Agencija za zaštitu osobnih podataka (AZOP) and, in Portugal, the Comissão Nacional de Proteção de Dados (CNPD). We would appreciate the chance to address your concern first.
13. Candidates (job seekers)
Corvana does not charge workers recruitment fees. We process candidate data only when needed for a specific vacancy, through licensed recruitment partners where required. Candidates receive appropriate notice and, where required, are asked for consent. We collect only what is necessary for that vacancy. Candidates have the same rights as described above.
14. Automated decision-making
We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects for you.
15. Changes to this notice
We may update this notice. The current version is always published on this page, with the date it was last updated.