What we do with your details.

Q&A Consulting L.L.C., Rr. Llapi Nr.57, Prishtina, Republic of Kosova, a recruitment agency. We decide how your details are used, which makes us the controller under the GDPR and Kosova’s Law No. 06/L-082 on the protection of personal data. Reach us at hello@qnaconsulting.net or +383 45 333 993.

• When you apply for a role: your name, email, phone and LinkedIn address if you give them, your CV, anything you write in the form, the role, the date, and the campaign that brought you, if any.
• If you tick “keep my details”: the same, plus the date you agreed.
• When you introduce yourself or send a hiring brief: those forms open your own email program, so we receive what you choose to send, by email.
• To stop spam: Cloudflare Turnstile checks your browser when you send the application form. It processes your IP address and browser signals; we don’t store them.
• Server logs: our host records IP addresses and requests for a short time, to keep the site secure.

The public site sets no advertising or analytics cookies.

• To consider you for the role you applied for and talk to you about it: because you asked us to, before a possible contract (GDPR Art 6(1)(b)), and our legitimate interest in recruiting for our clients (Art 6(1)(f)).
• To keep you in mind for other roles: only with your consent, the separate box on the form (Art 6(1)(a)). It is never a condition of applying, and you can withdraw it at any time.
• To keep the forms free of spam and abuse: our legitimate interest (Art 6(1)(f)).

We don’t make decisions about you by automated means alone. A person reads every application.

• Our team: the consultant responsible for the role, and the recruiters working on it.
• The employer: only after you have agreed, and only for that role. We never send your CV anywhere without your yes.
• Our service providers, who process it for us under contract and nothing else: Supabase (database and file storage, in Frankfurt, Germany), Vercel (hosting), Resend (email delivery), Cloudflare (the spam check) and Google Workspace (our email).

Vercel, Resend, Cloudflare and Google are US companies, so some details may be processed outside Kosova and the EU. Those transfers rely on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

You applied and weren’t hired

6 months after the role closes. Then your CV and details are deleted; we keep only an anonymous record that an application existed.

You ticked “keep my details”

12 months from our last contact. Before that runs out we ask whether to keep them; without a yes, we delete them.

You were hired

As long as the employment or contract needs it, reviewed once a year.

If you ask us to delete your details sooner, we do, unless the law requires us to keep something.

You can ask us for a copy of your details, to correct them, to delete them, to limit what we do with them, or to send them to you or someone else in a usable format. You can object to anything we do on the basis of legitimate interest, and withdraw your consent at any time; withdrawing doesn’t undo what was done before.

Email hello@qnaconsulting.net with “Privacy” in the subject. We answer within one month. If you’re unhappy with the answer, you can complain to Kosova’s Information and Privacy Agency (aip.rks-gov.net) or to the data protection authority where you live or work.

To consider an application we need your name, your email and your CV; without them we can’t. Everything else on the form is optional, and so is the box that keeps your details for other roles.