Privacy Policy
Last updated: July 1, 2026
DevNull SHPK operates Quadune and is committed to protecting your privacy. This Privacy Policy explains who is responsible for your personal data, what data we collect, why and on what legal basis we process it, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR) and applicable Albanian data protection law. By using Quadune, you acknowledge the practices described in this policy.
Data Controller
The controller responsible for processing your personal data is: DevNull SH.P.K. NIPT: M52222019J Registered address: Rruga Tefta Tashko, Pallati Palushi shpk, Kati 2, 1001 Tiranë, Albania For any privacy matter, including the exercise of your data subject rights, you can contact us at [email protected].
Information We Collect
We collect information that you provide directly when creating an account and using our services: - Account information: full name, email address, and password (passwords are stored only as a cryptographic hash, never in plain text). - Profile information: professional headline, biography, date of birth, city, and links (LinkedIn, portfolio). - Documents: CVs, cover letters, and other files you upload. - Job preferences: preferred categories, job types, location types, and salary expectations. - Application data: cover messages and documents submitted with job applications. - Company information (employers): company name, description, industry, size, location, logo, and gallery images. - Authentication data: if you sign in with Google, we receive your name, email address, and email-verification status from Google. We also use one-time codes (OTP) sent to your email to verify your identity. We also automatically collect limited technical data, such as IP address, browser type, device information, and usage patterns, which is necessary to operate, secure, and improve the platform. We do not intentionally collect special categories of personal data (e.g. data revealing health, religion, or political opinions). Please do not include such information in your CV or profile unless strictly necessary.
How We Use Your Data and Legal Bases
We process your personal data for the following purposes, each relying on a legal basis under Article 6 GDPR: - To provide and operate the platform, manage your account, and process job applications and communication between seekers and employers — performance of a contract (Art. 6(1)(b)). - To send service notifications about application status, matching jobs, and important platform updates — performance of a contract and our legitimate interest (Art. 6(1)(b) and (f)). - To secure the platform, prevent fraud and abuse, and scan uploaded files for malware — our legitimate interest in keeping the service safe (Art. 6(1)(f)). - To improve our services, fix issues, and develop new features — our legitimate interest (Art. 6(1)(f)). - To set analytics and advertising cookies and similar technologies — only with your consent (Art. 6(1)(a)); see the Cookies section and our Cookie Policy. - To comply with legal obligations and respond to lawful requests — compliance with a legal obligation (Art. 6(1)(c)). Where we rely on legitimate interest, you have the right to object as described in the Your Rights section.
Data Sharing and Sub-Processors
We do not sell your personal data. Your information is shared only in the following circumstances: - With employers: when you apply for a job, the employer receives your application details, including your profile information, CV, and cover message. - With service providers (sub-processors) who process data on our behalf under data processing agreements and strict confidentiality: • Hetzner — server hosting (EU) • Cloudflare — DNS, reverse proxy, and TLS (EU edge) • Amazon Web Services (S3) — file and backup storage, region eu-central-1 • Amazon Web Services (GuardDuty Malware Protection for S3) — malware scanning of uploaded files, region eu-central-1 • Mailgun — transactional email delivery (EU) • Sentry — application error tracking, configured to filter out email addresses and other PII (EU) - Legal requirements: we may disclose information where required by law or to protect the rights, property, or safety of our users and the platform. International transfers: our infrastructure and sub-processors are located in the EU/EEA. We do not transfer your personal data outside the EU/EEA. Should any transfer become necessary in the future, it will be made under an adequacy decision or appropriate safeguards (such as Standard Contractual Clauses) as required by GDPR Chapter V.
Data Retention
We retain your personal data for as long as your account is active. If you delete your account, we remove your personal information without undue delay, except where retention is required by law or for the establishment, exercise, or defence of legal claims. Job application records may be retained for up to 12 months after the associated job listing is closed, to allow employers to complete their hiring process. Encrypted database backups are kept on a rolling 30-day retention cycle; data removed from the live system is purged from backups within this window as backups expire.
Your Rights
Under the GDPR and applicable Albanian data protection law, you have the right to: - Access: obtain confirmation of and a copy of the personal data we hold about you (Art. 15). - Rectification: correct inaccurate or incomplete data; you can edit most profile information directly at any time (Art. 16). - Erasure: request deletion of your account and associated personal data (Art. 17). - Restriction and objection: restrict or object to processing based on our legitimate interest (Arts. 18 and 21). - Data portability: receive your data in a structured, commonly used, machine-readable format (Art. 20). - Withdraw consent: withdraw consent for cookies or optional communications at any time, without affecting prior lawful processing (Art. 7(3)). Self-service tools: you can export a complete copy of your data as a JSON file, and permanently delete your account (with all linked data) directly from your account settings — no request needed. For anything else, contact [email protected]. We respond to rights requests within one month. If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the Albanian Information and Data Protection Commissioner (IDP) or, if you are in the EU/EEA, with your local supervisory authority.
Cookies
Quadune uses strictly necessary cookies to operate the platform: - Session cookies: to keep you logged in and maintain your authentication state. - Preference cookies: to remember your language selection and display preferences, and your cookie choice. With your consent, we also use analytics and advertising cookies (for example Google Analytics and Google AdSense) to understand how the platform is used and to support the free service. These are set to deny by default under Google Consent Mode v2 and load only after you opt in via our cookie banner. You can change or withdraw your choice at any time. For full details, see our Cookie Policy.
Security
We apply appropriate technical and organisational measures to protect your data, including: - Encryption in transit (HTTPS/TLS) for all traffic. - Password hashing — credentials are never stored in plain text. - Malware scanning of uploaded files via our cloud provider's malware protection service; files flagged as malicious are blocked from download. - Access controls, network isolation between services, and continuous error and security monitoring. - Encrypted, access-controlled backups with a 30-day retention cycle. No method of transmission or storage is completely secure, but we work continuously to protect your information and to respond promptly to any incident.
Children's Privacy
Quadune is intended for users aged 16 and over. We do not knowingly collect personal data from children below this age. If you believe a minor has provided us with personal data, please contact [email protected] and we will delete it promptly.
Employer Notes on Applications
Employers who review job applications on Quadune may add internal notes to individual applications. These notes are visible only to the employer who created them and are not shown to job seekers through the platform interface. In accordance with your right of access (Art. 15 GDPR), if you are a job seeker and wish to obtain a copy of any internal notes held about you, you may submit a data access request to [email protected]. We will coordinate with the relevant employer to retrieve and provide this information where legally required.
Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "last updated" date and, where appropriate, notify registered users by email or platform notification. We encourage you to review this policy periodically.
Contact Us
If you have any questions or concerns about this Privacy Policy or how we handle your data, please contact us at: DevNull SHPK [email protected]