Privacy Policy.

Last updated: 4 November 2026. Public submissions remain closed until launch.

1. Who is responsible

OUTLINERS Ε.Ε. (trading as OUTLINERS), 23 Kallirrois Street, 11743 Athens, Greece, Tax ID 802260643, GEMI 173168403000, is the controller for this website and its recruitment activities. Privacy and rights requests: info@outliners.gr.

2. Candidate information and purposes

We collect the name, contact details, professional specialization, preferred location, CV, and any optional LinkedIn profile or introduction you provide. Please exclude identity-document numbers, health details and other unnecessary sensitive data. Required fields allow us to identify and contact you and assess your professional profile; without them we cannot process a submission.

For a specific opportunity, enter the role or reference. We assess your application and contact you about that opportunity on the basis of our legitimate interests in responding to candidate-initiated applications and providing proportionate recruitment services (GDPR Article 6(1)(f)), subject to your interests and rights. We do not use this as permission to retain your CV for unrelated opportunities.

Future-opportunity talent pooling is separate and optional: only an unticked opt-in allows us to retain and contact you about other suitable roles, on the basis of consent (Article 6(1)(a)). You can apply for a specific role without opting in. A general CV submission without a specific role requires choosing this optional service. You may withdraw consent at any time by email; declining or withdrawing does not affect an application for a specific role.

3. Client enquiries and other contact

Request Talent collects business contact details, company, role, location, employment type, timeline, hiring needs and optional attachment/salary information. We process these to answer enquiries and discuss an engagement, based on legitimate interests in business communications (Article 6(1)(f)); Article 6(1)(b) applies where the individual is a party to a proposed contract and requests pre-contractual steps. Legal obligations (Article 6(1)(c)) apply where required. Acknowledging this notice is not blanket consent to every purpose.

4. Sharing and who can access data

Only the authorized OutLiners Owner has routine access to the private Talent Dashboard and CV files, protected by Microsoft Entra ID and MFA. Infrastructure administrators and providers may have restricted operational/recovery access. The website does not automatically forward CVs, rank candidates or take automated decisions with legal or similarly significant effects.

Before sharing a profile with a particular prospective employer, we explain the opportunity, recipient and purpose and obtain your specific authorization/consent. The employer then processes it under its own privacy notice. We share only necessary details and do not sell CVs or publish download links. Withdrawal stops future consent-based sharing but cannot reverse lawful prior processing; recipients have their own applicable duties.

Microsoft Azure (Static Web Apps, Functions and Blob Storage) hosts the website/backend. CV storage and backend are configured in North Europe. Microsoft Entra ID provides Owner authentication. Microsoft 365/Exchange Online is used for email correspondence; the mailbox remains administered in the ATCOM tenant. ATCOM is not given routine access to the Talent Dashboard or CV storage. We use GitHub for code and CI, not as a candidate database; submissions and secrets must not be committed there. Authorized service providers process data under applicable contractual terms. Email notifications are disabled and are not required to store a submission.

5. Analytics and cookies

With your prior optional consent, Google Analytics 4 measures visits, approximate country, traffic channels, public pages and counts of successful submissions. We do not send names, email addresses, phone numbers, CV contents or candidate/submission identifiers to Analytics. Query strings and fragments are excluded from page measurements. Analytics is not installed in the private Dashboard. Google tags remain blocked without consent or if Analytics has not yet been configured. Read the Cookie Policy and use Cookie settings in the footer at any time.

6. International transfers

EU-region CV storage does not mean every provider operation remains exclusively in the EEA. Microsoft and its subprocessors may perform limited support/security operations from other countries under its Data Protection Addendum and applicable safeguards. Consented Google Analytics processing may involve Google Ireland Limited, Google LLC and infrastructure outside the EEA, including the US. Applicable safeguards include adequacy decisions where available and standard contractual clauses where required; the relevant provider terms must apply to the configured accounts. Ask us for information or copies of the relevant safeguards.

Provider information: Microsoft DPA, Microsoft transfer information, Google transfer safeguards.

7. Retention and security

A future-opportunity CV is retained for up to 12 calendar months from submission. A specific-opportunity-only submission has a shorter three-calendar-month maximum, and is removed earlier when no longer needed or when a valid erasure request applies. Client enquiry records have a 12-calendar-month maximum in this intake system. A new submission is not automatic consent renewal. Contract, accounting or legally required records, if any, are handled separately and limited to the applicable purpose and period; they do not silently extend CV storage in this system.

The hourly maintenance function removes due files, metadata and review state. Expired records are excluded from Owner access even before the next sweep. If deletion fails, the system retries; seven-day Azure Blob soft deletion permits limited infrastructure recovery without ordinary Dashboard access. If data is restored for recovery, expiry must be reapplied. We use private storage, restricted identities, encryption in transit, size/type checks and abuse limits. No system can promise absolute security.

Technical providers process connection/security information for service delivery. Our application uses salted pseudonymous abuse fingerprints: short-window counters/intents are pruned within 24 hours plus the next maintenance run; aggregate monthly quotas contain no raw IP. We do not intentionally log form contents or tokens. Provider operational logs follow the relevant service configuration and contractual retention, rather than the CV deletion schedule.

8. Your rights and contacting us

Where applicable, you may request access, correction, erasure, restriction and portability, object to legitimate-interest processing, and withdraw consent without affecting prior lawful processing. Email info@outliners.gr with your request; we verify identity proportionately without asking for unnecessary documents. We normally respond within one month; a lawful extension will be explained within that period. Some rights have legal exceptions. You can complain to the Hellenic Data Protection Authority. We will communicate material changes before using information for a new incompatible purpose.