Privacy policy

Cruit B.V. is a Dutch company based in Amsterdam. We operate the Cruit employee referral platform at cruit.app. Questions? Email privacy@joincruit.com.

When you run a referral program on Cruit, you are the data controller for employee and candidate data, and Cruit acts as your processor. For the marketing website and referral scan, Cruit is the controller.

Website visitors: cookies (analytics and advertising only after consent, see our cookie policy), and any information you submit in a referral scan request: name, work email, company domain, company size.

Your employees: on your behalf: name, work email, department, referral activity, credits earned and spent, leaderboard position. Authentication is via magic link; we do not store passwords. If you connect an HRIS, employee records sync automatically.

Referred candidates: name, contact details, and application information as provided by the referrer. If your ATS is connected, the referral syncs into it with the source attached and hiring-stage progress is tracked for reward payout.

Administrators: name, work email, role, and configuration decisions within the platform.

Cruit uses AI to generate programs, draft campaigns, and suggest challenges. It processes company and aggregated program data, not individual profiles. Administrators approve all AI suggestions before execution.

Only parties needed to run the service: the ATS and HRIS providers you connect, hosting and infrastructure providers, email and Slack for notifications, reward fulfilment partners, and (with consent on the website) Google Analytics, Google Ads, and LinkedIn. We do not sell personal data.

Under the GDPR, data subjects (your employees, referred candidates) can access, rectify, erase, restrict, port, or object to their data, and withdraw consent at any time. As your processor, we route such requests to you unless we can act on them directly. For data where Cruit is the controller, requests go to privacy@joincruit.com; we respond within one month.

You can lodge a complaint with the Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl, or with your local supervisory authority.

Material changes are communicated via the platform or email. The date at the top reflects the current version.