Processing of your personal data when applying for a job with us and as an employee at Devspace
When you apply for a job with us or are employed by us, we will process personal data about you in connection with the recruitment process and, if you are hired, in our capacity as your employer. Below, you will find information about the personal data we collect, why we process it, and your rights in relation to the processing of your personal data.
1. Data controller
Devspace is the data controller, meaning that we determine the purposes and means of the processing of personal data described below.
Contact details for the data controller:
Address: Bogstadveien 27B, 0355 Oslo
Email: contact@devspace.no
Phone: +47 40474458
Organisation number: 834260042
If you have any questions about how we process your personal data, you can contact us at contact@devspace.no.
2. Why we collect personal data and what information we collect
All processing of personal data is carried out in accordance with applicable data protection legislation, including the Norwegian Personal Data Act and the General Data Protection Regulation (GDPR).
“Personal data” means any information relating to an identified or identifiable natural person (the “data subject”).
“Processing” means any operation performed on personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
We collect and use your personal data for various purposes related to your recruitment process and, where applicable, your employment and working relationship with us. Below you will find more information about these processing activities:
Recruitment
When you apply for a position at Devspace, we process personal data about you in order to manage the recruitment process, assess your suitability for relevant positions and, if you are offered employment, prepare for entering into an employment agreement. In connection with your application, we process information that you provide in the application, as well as information contained in your CV and other documents submitted to us.
Devspace may format your CV to ensure that it follows a standard format used within the organisation. As part of this process, we may obtain a profile picture from publicly available sources, typically LinkedIn, where this is necessary to adapt your CV to our standard format. We do not collect other information from publicly available sources for this purpose.
If you are considered suitable for a specific project with one of our business partners, your CV may be shared with the relevant partner for further assessment. The purpose of the sharing is to enable the partner to assess your qualifications and suitability for the specific project. Devspace will remain your employer if you are hired.
If you are invited to an interview, an AI-based solution may be used to make a video recording of the interview and prepare notes or summaries. Information from your application, CV, interview and assessments made during the recruitment process is stored in a candidate profile in our recruitment database. If the interview is recorded, you will be informed in advance.
For candidates who are offered employment, we carry out an identity check before the employment agreement is signed. Identification documents processed as part of the identity check are deleted no later than 120 days after they are uploaded to the relevant system.
For certain positions, we may also carry out a background check. The scope of the background check will depend on the nature of the position and the need for such verification. You will be informed before any background check is carried out.
Processing of personal data that is necessary to assess your application, carry out the recruitment process and, where applicable, enter into an employment agreement is based on Article 6(1)(b) GDPR.
The use of an AI agent for video recording and preparation of interview notes, as well as the adaptation of your CV to Devspace’s standard format, including obtaining a more suitable profile picture from publicly available sources, is based on our legitimate interests pursuant to Article 6(1)(f) GDPR. Our legitimate interest is to conduct an efficient, documented and consistent recruitment process.
If you are not offered a position, your personal data will be deleted after the recruitment process has been completed, unless you expressly consent to us retaining your candidate profile for consideration for future positions. If you provide such consent, Devspace may contact you if a relevant position becomes available at a later date. This processing is based on your consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time.
Processing of personal data during employment – financial and personnel administration
Devspace processes personal data about you in order to administer the employment relationship and fulfil our obligations as an employer. This includes, among other things, salary payments, recording working hours and absence, personnel administration, and compliance with statutory and contractual obligations.
The processing is based on the employment agreement, pursuant to Article 6(1)(b) GDPR, and on our legal obligations, pursuant to Article 6(1)(c) GDPR.
Personal data processed as part of personnel administration is generally retained for as long as the employment relationship continues and thereafter for as long as necessary to comply with legal obligations or documentation requirements. Information relating to finance, payroll and accounting is retained and deleted in accordance with applicable bookkeeping requirements.
3. Disclosure of personal data to third parties
When you are being considered for work on a specific project with one of Devspace’s business partners, your CV and other relevant information may be shared with that partner for the purpose of assessing your qualifications and suitability for the project. During the recruitment process, you will be informed about the relevant project, who your personal data will be shared with, and where the recipient is established.
If the business partner is established outside the EEA, the disclosure may involve a transfer of personal data to a third country. Where there is no adequacy decision or other transfer mechanism under Chapter V of the GDPR, the transfer may, in specific situations, be based on Article 49(1)(b) GDPR where the transfer is necessary to take steps at the candidate’s request prior to entering into an employment agreement or to perform the employment agreement. The candidate or employee will be informed about the specific transfer before it takes place.
We also use data processors that process personal data on our behalf, including in connection with recruitment, HR administration and IT services. We enter into data processing agreements with such providers to ensure that personal data is processed in accordance with applicable data protection legislation.
4. Your rights when we process your personal data
Below is an overview of your rights in relation to our processing of your personal data. To exercise your rights, please contact contact@devspace.no.
We will respond to your request as soon as possible and no later than within one month. If we need more than one month to respond, you will be informed.
Information
You have the right to receive information about the personal data we process about you. This privacy notice explains how we process your personal data. If you need further information, please contact us using the details above.
Access
You have the right to request access to the personal data we process about you.
Rectification and erasure
You may ask us to correct inaccurate personal data or request that your personal data be deleted.
Restriction and objection
You may request restriction of processing in certain circumstances, including where you contest the accuracy of the data, the processing is unlawful and you prefer restriction instead of erasure, or we no longer need the data but you require it to establish, exercise or defend legal claims.
You may also object to processing that is based on our legitimate interests.
Data portability
For personal data that you have provided to us, which is necessary for the performance of a contract with us and is processed by automated means, you may request to receive the data or have it transferred to another controller in a structured, commonly used and machine-readable format.
Automated decision-making, including profiling
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
5. Complaints
If you believe that our processing of personal data is not in accordance with this privacy notice, or that it otherwise violates applicable data protection legislation, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).
We would appreciate it if you contact us before submitting a complaint to Datatilsynet, so that we have an opportunity to review the matter and clarify any questions or misunderstandings.
Information on how to contact Datatilsynet is available at www.datatilsynet.no.
6. Changes
If there are changes to how we process your personal data in connection with your recruitment or employment, the information provided in this privacy notice may also be updated. We will inform you of any material changes.
This privacy notice was last updated on October 2, 2026.