GradGuide Privacy Policy
Effective date: 07/08/2026
Welcome to GradGuide (the "Platform"). We are legally obligated to protect your personal data, and we respect your privacy. As we work with personal information from both Clients and Job Seekers, we are committed to safeguarding it. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, Www.GradGuide.nl, in compliance with the General Data Protection Regulation (GDPR).
- Contact Information
- Information We Collect
We may collect and process the following data about you:
- Automatically collected information:
- IP-Address.
- Geo-location information.
- Usage data.
- Browser type and version.
- Device type.
- Security-related technical identifiers: We may generate a temporary device identifier (sometimes referred to as a "browser fingerprint") based on technical information such as your IP address, browser configuration, and device characteristics. This is used solely to detect and prevent automated abuse, excessive usage, or misuse of our AI systems and to protect the security and integrity of our Platform. This identifier is not used for advertising or behavioral tracking.
- Cookies, local storage and similar technologies: We use strictly necessary storage to keep you signed in and remember your cookie choice, functional storage to run features such as the Aurora chat (including for visitors who are not logged in), and, only if you choose "Accept all", analytics and marketing technologies from partners such as Google, Meta, TikTok and LinkedIn. You set your preference in our cookie banner and can change it at any time. Full details, including every cookie and storage item we use, are in our Cookie Policy.
- Information we collect when you create an Account:
- First and last name.
- Email address.
- Marketing and communications data.
- Professional information such as a resume that you actively provide by opting to connect with companies:
- Information you import from LinkedIn (with your consent):
- If you choose to connect your LinkedIn account, we import certain information from your LinkedIn profile, such as your work experience, education, and skills, through LinkedIn's Member Data Portability API. We do this only with your explicit consent. We use it to create or enrich your GradGuide profile so you don't have to enter your professional history manually. You can view, edit, or delete this information at any time in your profile, and you can withdraw your consent or disconnect LinkedIn at any time; withdrawing consent stops any further import. We do not use this data for advertising and do not sell it.
- Information from AI practice sessions (consulting cases, drills, and assessment practice):
- When you practice with our AI coach (for example a consulting case interview, a skill drill, or a timed assessment practice test), we store the practice conversation and your practice results (per-skill scores and the AI's feedback notes) in your account. We use these only to show you your own progress and to personalize your preparation plan. Practice sessions are deliberately kept separate from your career profile: what you say or score during practice is never added to the career profile that recruiters can see, and your individual practice results are never shared with employers.
- Information when you use Aurora without an account:
- If you chat with Aurora before signing in, we store your conversation in your browser and on our servers, linked to a random identifier (not your name), so the chat keeps working and we can apply fair-use limits. If you later sign in, we offer to move that conversation into your account; otherwise it is retained only for a limited period and then deleted.
- How We Use Your Information
We use the information we collect in the following ways:
- To provide, operate, and maintain our Platform.
- To improve, personalize, and expand our Platform.
- To understand and analyze how you use our Platform to improve our platform and offering and to customize these to your preferences.
- To develop new products, services, features, and functionality.
- To connect users with recruiters and facilitate the recruitment process.
- To communicate with you, either directly or through one of our partners, including for customer service, to provide you with updates and other information relating to the Platform, and for marketing and promotional purposes.
- To contact you through e-mail or via telephone where necessary to provide our services.
- To inform you of any changes in our services or products.
- To allow you to create an Account on our platform.
- To deliver our services.
- To detect, prevent, and investigate fraud, automated abuse, excessive usage, or misuse of our AI systems.
- To comply with legal obligations.
- To create and enrich your career profile from the information you provide or, with your consent, import from LinkedIn, so we can offer you more relevant job matches and career guidance.
- To show you your own progress in practice modules (such as consulting case practice) and to personalize your preparation plan based on your practice results.
- Legal Basis for Processing Personal DataWe rely on the following legal bases to process your personal data:
- Consent: We may process your data where you have given us specific consent, for example when you choose to import your profile information from LinkedIn, to deliver our services.
- Legal obligation: We may process your data where we are legally required to do so.
- Legitimate interest: We may process your personal data where it is necessary for our legitimate interests, such as securing our Platform, preventing fraud and automated abuse, protecting our AI systems from misuse, and ensuring fair usage, provided that these interests are not overridden by your data protection rights.
- Sharing Your Information
We only share your personal data with a company or recruiter ("Company") when you take a deliberate action that requires it, and we record your consent at that moment. We also share data in the limited circumstances below:
- Sharing with employers and recruiters:
- Applying to a vacancy on GradGuide: When you submit an application, you ask us to share it with the relevant Company. We share what is needed to assess your application: typically your name, contact details, the career profile you built on GradGuide (education, experience, skills) and your motivation. We record which Company, which vacancy, and when you agreed.
- Applying on a Company's own website: Some vacancies link out to the Company's own application page. When you click through you leave GradGuide; your application there is governed by that Company's privacy policy. We do not send your profile in this case. We only record that you clicked, to measure interest and improve matching.
- Open to work: If you switch on "Open to work" in your settings, you allow verified Companies on GradGuide to discover your career profile and approach you. This is off by default, you control what is visible, and you can switch it off at any time. Switching it off stops future sharing; we cannot recall data a Company has already seen or saved.
- Introductions to a Company: A Company may ask us to find candidates for a specific role. We match your career profile against that role internally and, if you are a good fit, we email you an invitation describing the Company and the role. Nothing is shared with the Company at that point. Being matched is not being disclosed. Only if you click Accept do we share your profile, and we show you the exact list of what will and will not be shared before you decide. We never share your chat history, practice or assessment results, or your activity data. If you decline, or simply do not respond, the Company is not told who you are. We record the moment you accepted and the policy version in force, and you can ask us to withdraw an introduction at any time.
- Employer-sponsored practice access:
- Some organizations (for example, an employer whose interviews you are preparing for) may sponsor free access to our practice modules through an invite or access code. If you redeem such a code, we record that your account belongs to that sponsor's cohort so we can provide the sponsored access and report on the program. The sponsor receives only aggregate, anonymized engagement statistics about the cohort as a whole, such as how many invited candidates activated their access and total practice volume. The sponsor never receives your individual practice results, scores, feedback, conversation content, or any report on whether you personally practiced. Redeeming a sponsor code does not add the sponsor to your career profile audience and does not create any sharing of your profile with the sponsor.
- Legal obligation: We may disclose your information if required to do so by law or in response to valid requests by public authorities.
- Business transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
- Service providers: We may share your data with third-party service providers who perform services on our behalf.
- Social media platforms: Where permissible according to applicable law we may use certain limited Personal Information about you, such as your email address, to share it with social media platforms, such as Facebook, Google, or LinkedIn, to generate leads, drive traffic to our websites or otherwise promote our products and services of GradGuide. These processing activities are based on our legitimate interest in undertaking marketing activities to offer you products or services that may be of your interest.
- Aggregated Information: We may share aggregated information (i.e., data about our users that we compile in a manner that no longer identifies or references any individual user) and other anonymized information. This is used for purposes such as regulatory compliance, industry and market analysis, demographic profiling, marketing and advertising, and other business purposes, like creating reports with aggregated insights for Employers. This aggregated information does not identify you.
You can withdraw these consents at any time in your settings or by contacting us. Withdrawal does not affect sharing that already took place. The legal basis for sharing with Companies is your consent (Art. 6(1)(a) GDPR).
- Your Data Protection RightsUnder the GDPR, you have the following rights:
- Right to Access: You have the right to request copies of your personal data.
- Right to Rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
- Right to Erasure: You have the right to request that we erase your personal data, under certain conditions.
- Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
- Right to Object to Processing: You have the right to object to our processing of your personal data, under certain conditions.
- Right to Data Portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.
If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us at our contact information provided above.
To ensure that the request for access was made by you, we ask that you include a copy of your ID with the request. In this copy, please black out your photo, MRZ (machine readable zone, the strip of numbers at the bottom of the passport), passport number, and Citizen Service Number (BSN). This is to protect your privacy.
- Minor's and Children's Privacy
The Platform and/or service does not intend to collect data about website visitors who are under 18 years old, unless they have permission from their parents or guardian. However, we cannot verify whether a Visitor is over 18. Therefore, we recommend that parents be involved in their children's online activities to prevent data from being collected about children without parental consent. If you believe that we have collected personal data about a minor without such permission, please contact us and we will delete this information.
- Data Security
GradGuide takes the protection of your data seriously and takes appropriate measures to prevent misuse, loss, unauthorized access, unwanted disclosure, and unauthorized modification. If you have the impression that your data is not properly secured or there are indications of misuse, please contact us at our contact information provided above.
While we have taken reasonable steps to secure the personal information you provide to us, please be aware that no security measures are perfect or impenetrable, and no method of data transmission can be guaranteed against any interception or other type of misuse.
If a data breach occurs that is likely to affect your rights, we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours where required, and inform you without undue delay where the breach is likely to result in a high risk to you.
- Payment Information
When you purchase a paid plan, your payment is processed by Mollie B.V., our payment processor, acting on our behalf. We receive and store a payment and subscription reference, the plan purchased, the amount, the billing status and renewal dates; we do not receive or store your full card number or bank account number. We retain payment and invoice records for as long as required to meet our tax and accounting obligations (in the Netherlands, generally seven years).
- Data Retention
We keep your account and profile data for as long as your account is active and delete it after account termination, except where the law requires a longer period. Security and audit logs are kept for up to 12 months. Anonymous chat data is kept only for a limited period and then deleted.
- Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the effective date. You are advised to review this Privacy Policy periodically for any changes.