How we handle your application data

Who is responsible

CENIT Consulting AS, Org nr 927 068 419, Erik Werenskioldsvei 14B, 4023 Stavanger, Norway, is the controller. We have not appointed a data protection officer, because we are not required to. Send all privacy questions to eirik.lima@cenitconsulting.com.

How we review applications

Experienced regulatory and quality consultants at CENIT read every application and make every decision. We use an AI tool, Claude by Anthropic, to help them work quickly and consistently.

Drafting your form. When you upload a CV or LinkedIn profile, the AI drafts your application form and may ask one or two questions about your experience. You check and correct everything before you submit. We record which fields the AI drafted, which you edited and which you typed.

A structured first assessment. After you submit, the AI reads your application and rates it from 0 to 5 on seven points: hands-on authoring of regulatory documents; depth and recency of relevant competencies; consistency of your work history with your CV; qualifications; fit with how we work commercially; possible conflicts of interest with our clients; and written English. For each it gives reasons and points to the evidence. It also lists strengths, gaps and three questions our team may want to ask you. Our software adds the ratings up to an overall indication from 0 to 100 and a suggested priority (A, B or C). Fixed checks also highlight, for example, missing dates, refusal of our terms, or text that tries to instruct the AI.

What this means for you. The assessment is a starting point for a person, not a decision. A highlighted point is a reason to ask you a question, not a finding against you. A higher indication makes it more likely that we contact you about assignments; a lower one can make it less likely, but only if a person agrees after reading your application.

What the AI does not consider. Your location, nationality, the language of your documents, age, gender, ethnicity, religion, health, disability, family status and photographs play no part. We test the system with sample profiles, including profiles that differ only in such characteristics, and check every change before we use it.

Emails. The AI may prepare a first draft of emails and test-task briefs we send you. A person at CENIT reads, edits and sends them.

No automated decisions

We do not make decisions about you by automated means alone. The AI never shortlists or declines an application. If our software sees that you have refused our white-label or non-solicitation terms, or that you do not have a registered business, it highlights this for our team; a person checks your answers and decides. Every shortlist and every decline is made by a person, who records the reason. You can ask us for that reason, give us your view, and ask a person to look at your application again.

What we collect

From you: your name, email, phone, country, time zone, LinkedIn URL and website; your business details and professional indemnity insurance; your English level; your work history, competencies, documents you have written, qualifications and certificate copies; availability, expected rate and answers to our terms; the files or text you upload; answers to our questions; and the names and contact details of your references.

If you sign in with LinkedIn: your name, email address and LinkedIn member identifier. We do not store your photo.

If you upload a LinkedIn data export: we read only the profile, positions, education, certifications, skills and languages files, and we do not keep the archive itself. We never read connections or messages.

What we create: the drafted form, the assessment, our notes, the reasons for our decisions, and the emails we send you.

From others: if we contact your references, we keep a short summary of what they tell us.

Technical data: a session cookie, and your IP address or email address in a spam-protection record for 48 hours.

Please do not send us information about your health, religion, ethnic origin, political opinions, trade union membership or sexual orientation. We do not need it.

What you must give us

Applying is voluntary. To assess an application we need your email address and a description of your experience (a CV, LinkedIn profile or text). To work with you we also need your business details and your answers to our commercial terms; without them we cannot complete the assessment. Other fields are optional; leaving them empty means we have less to go on. We work only with registered businesses that accept white-label and non-solicitation terms.

Why we use your data, and on what legal basis

• To assess your application and talk to you about it: steps you ask us to take before a contract (GDPR Article 6(1)(b)).
• To assess applications consistently with the help of AI, check facts, detect fraud or manipulation, and check references: our legitimate interest in recruiting qualified and reliable consultants for regulated MedTech work (Article 6(1)(f)).
• To contact you about assignments during the retention period: legitimate interest (Article 6(1)(f)).
• To protect the portal against spam and abuse: legitimate interest in keeping our systems secure (Article 6(1)(f)).

You can ask us how we balanced our interests against yours, and you can object (see Your rights).

Who processes your data for us

• Supabase: database and file storage, Frankfurt, Germany.
• Netlify: website hosting and server functions, United States.
• Anthropic: the AI (Claude), United States. Anthropic does not use your data to train its models and, under its current terms, keeps API data for up to 30 days for abuse monitoring before deleting it.
• Resend: sending emails, Ireland.
• Cloudflare: spam and bot protection (Turnstile), global network, without tracking cookies.

For processing in the United States we rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the EU standard contractual clauses. You can ask us for a copy of the safeguards. Only CENIT's two reviewers can see your application.

How long we keep it

• Submitted applications: 24 months from your last activity. Then we anonymise the record automatically: we delete your files, text, notes and contact details and keep only the stage reached, the overall indication and dates, which cannot identify you.
• Unfinished applications: deleted 6 months after your last activity.
• Spam-protection records: deleted after 48 hours.
• References' details: kept and anonymised together with your application.

You can ask us to delete your data earlier.

Your references

If you name references, please tell them. We contact references only when we are considering working with you. When we do, we tell them who we are, why we have their details and what their rights are.

Cookies

We use only cookies that are strictly necessary. No analytics, advertising or tracking cookies.

• cenit_apply: keeps you in your application after you open the link in your email; up to 7 days.
• li_state: protects the "Sign in with LinkedIn" step; 10 minutes.
• Admin sign-in cookies: used only by CENIT's reviewers.

Your rights

You can ask us to:

• give you a copy of your data and tell you how we use it;
• correct data that is wrong or incomplete;
• delete your data;
• restrict our use of your data while a question is resolved;
• give you your data in a machine-readable format;
• stop using your data on the basis of our legitimate interest, for example review your application without the AI assessment;
• explain the assessment and have a person review your application again.

We answer within one month (up to two more months for complex requests; we will tell you why). Email eirik.lima@cenitconsulting.com; we may ask you to confirm from the address you applied with. You can also complain to Datatilsynet (www.datatilsynet.no) or your local data protection authority.