- Candidate profiles are private by default and can be found in candidate search only after visibility is explicitly enabled.
- Each application creates a separate snapshot of the selected data for the specific employer.
- System contact details are visible to the selected employer by default upon application, but candidates may lock them until an invitation.
- Karlion does not use fully automated employment decisions or disclose private development results to companies without the user choosing to do so.
- Uploaded CVs are privately stored, security-scanned before use and accessible only to the entitled candidate and the recipient chosen by that candidate.
- Users may temporarily freeze a profile; it is then not publicly visible, but data remains stored and the profile reactivates only upon the next successful sign-in.
Controller and scope
The employment portal’s controller is Karlion, poslovno svetovanje, Gregor Vencelberger, s.p., Rakuševa ulica 8, 1000 Ljubljana, company registration number 7452632000, tax number 46836357. For questions and to exercise your rights, write to info@karlion.si or call +386 (0)31 515 717.
This policy applies to the portal at delo.karlion.si, its user accounts, public job listings, applications, messages, career development functions and portal administration. The general karlion.si policy applies to other Karlion websites and services.
Karlion and the employer do not always have the same role
Karlion is the controller of data needed for the account, portal operation and security, user settings, support, moderation, notifications and basic portal analytics.
When a candidate applies or accepts an invitation, the selected company processes the received data for its recruitment process as an independent controller. The employer must give the candidate its own processing information, use the data only for lawful recruitment purposes and respect retention periods and the candidate’s rights.
Which data we process and why
| Category | Examples of data | Purpose and legal basis |
|---|---|---|
| Account and identity | verified email, display name, secure password hash, role, session and account status | performance of the user relationship (Article 6(1)(b) GDPR); security and abuse prevention as a legitimate interest (Article 6(1)(f)) |
| Candidate profile | experience, skills, education, location, description, links, photograph, career preferences and optional salary expectations | functions requested by the candidate (Article 6(1)(b)); employers may search the profile on the portal only after voluntary activation (Article 6(1)(a)) |
| Applications and messages | profile snapshot, selected CV, cover message, statuses, invitations, responses and audit trail | fulfilment of the user’s request (Article 6(1)(b)); evidence of actions and legal claims as a legitimate interest (Article 6(1)(f)) |
| Company and listings | legal name, registration and tax numbers, website, business contacts, team members, logo, description and listing content | performance of the business relationship (Article 6(1)(b)); verification and abuse prevention (Article 6(1)(f)); legal obligations (Article 6(1)(c)) |
| Career tools | the latest final result of each tool, methodology and questionnaire versions and the user’s decision to include it in a profile or CV; the portal does not receive raw answers | voluntarily chosen function (Article 6(1)(b)); disclosure of a result is based on a separate user choice |
| Usage and security | listing opens, application clicks, sharing channel, action time, audit events and technical records | response measurement without a persistent public-visitor identifier, security and troubleshooting as a legitimate interest (Article 6(1)(f)) |
| Settings and requests | visibility, notifications, optional analytics, marketing and access, rectification or erasure requests | consent for optional purposes (Article 6(1)(a)); fulfilment of user choices and legal obligations (Article 6(1)(b) and (c)) |
Required fields are marked. Without data needed for an account, company, listing or application, the corresponding function cannot be performed. Users may leave optional fields blank or remove them later.
Do not enter special categories of personal data, criminal-conviction data or other people’s data in profiles, CVs, messages or listings unless this is lawful, necessary and appropriately protected for the specific process.
Data sources and document import
Most data is provided by users. Email addresses are verified using a one-time, time-limited link, and passwords are stored only as secure hashes. Company data may be checked against official or publicly available business registers. Listings and logos come from an authorised company representative.
When importing data from a CV or existing listing, the system proposes input fields. Users must check and confirm every field. A CV deliberately uploaded to the candidate’s library is privately stored on the server, remains inaccessible until a successful security scan and is not disclosed to an employer without the candidate choosing to do so. Any future external or AI document processing will be introduced only after separate information about the provider, purpose and safeguards.
Who receives the data
- a verified employer when the candidate applies, accepts an invitation or enables profile search;
- authorised Karlion personnel handling support, verification, moderation, security or data-subject requests;
- hosting, data-storage and email-delivery providers processing data to operate the portal;
- public authorities or other recipients where required by law or necessary to assert legal claims.
The portal operates in a managed application environment with a separate relational database and private object storage for user files. An uploaded document is sent from quarantine through a protected link to a separate antivirus scanner on Karlion’s EU VPS; the scanner returns only a limited scan result, and the document is not disclosed to an employer without a successful result. Karlion manages sign-in through its own email verification, securely stored password hashes and time-limited sessions. System notifications are forwarded from the portal to Karlion’s signed WordPress interface hosted by Webtasy, spletne storitve, d.o.o. (Domenca.com) and sent through mail.karlion.si. Karlion maintains a register of contracted processors, processing locations, subprocessors and safeguards; an updated list is available on request.
Some providers or their subprocessors may process data outside the European Economic Area. Such transfers take place only where an adequacy decision applies or appropriate safeguards under Chapter V GDPR are used, particularly valid standard contractual clauses and, where necessary, supplementary safeguards. Information about the mechanism used or a copy of the relevant safeguards is available on request, subject to protected business and security information.
Retention periods
When a period expires, Karlion erases or irreversibly anonymises the data unless there is a documented dispute, official request, security incident or another lawful basis. A legal hold applies only to the specific matter, and its imposition and release are recorded.
An employer is an independent controller of application copies received or exported into its own system and applies its own lawful retention periods. Erasure in Karlion therefore does not automatically erase the same copy from the employer’s system.
Your rights and control
Subject to the conditions of the GDPR, individuals may request access, rectification, erasure, restriction or data portability, or object to processing. Consent may be withdrawn at any time without affecting the lawfulness of past processing. Requests can be submitted in the “Account and privacy” centre or to info@karlion.si.
We may verify identity before acting on a request. Erasure is not always immediate if data is needed for an ongoing recruitment process, legal obligation or legal claim. For data independently processed by an employer in its own process, individuals may also contact that employer directly.
If you believe processing is unlawful, you may lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, ip-rs.si.
Automation, profiles and Karlion indices
The portal may help organise entered text into fields, calculate a user’s result, display recommendations or suggest improvements. These calculations are not a psychological or medical diagnosis and do not themselves decide on employment.
Karlion does not make decisions based solely on automated processing that produce legal or similarly significant effects. Employers must make their own decisions, use job-related criteria and prevent discrimination. Any future automated matching or assessment will be introduced only following a separate legal and ethical review and with clear safeguards.
Cookies, security and minors
The pilot uses an essential Karlion session cookie and safeguards that limit sign-in attempts. Optional analytics or marketing tracking are not enabled without the user’s prior choice. Public listing views are recorded without storing IP addresses, full referrer URLs or persistent visitor identifiers in the portal database.
We use role-based access restrictions, company verification, audit trails, private data storage and moderation. No internet transmission is entirely risk-free; report suspected abuse to info@karlion.si.
Self-registration is intended for persons aged at least 15. The portal has no process for verifiable parental or legal-representative approval, so anyone under 15 must not register. For minors, data scope must be particularly limited, without unnecessary photographs, locations or sensitive circumstances.
Policy changes
Every content version has a date and number. Users will be notified before a significant change affecting purposes, recipients or rights takes effect. Where new consent is required, continued use alone will not be treated as consent.
Legal references
The policy takes into account the General Data Protection Regulation (GDPR), ZVOP-2, ZDR-1 and the Information Commissioner’s guidance on employment relationships. These references assist review but do not replace an assessment of a specific organisation and its contracts.
Cookie settings
We use essential cookies or local storage for sign-in, security and your preferences. Optional analytics starts only after consent. Your choice is stored locally for up to 180 days; change or withdraw it using “Cookie settings”. When connected, Google Analytics measures public page categories only, without private URLs, search terms, CVs or contact details. Google may process device and connection data. We currently use no marketing trackers.