Privacy Policy

Move2Europe OÜ is the data controller responsible for processing your personal data. Based on a formal assessment of our processing activities under GDPR Art. 37, we have determined that appointment of a Data Protection Officer (DPO) is not required at this time. This assessment is documented internally and reviewed periodically. For any privacy-related questions, please contact us at privacy@move2europe.eu or by post to our registered address.

2. Scope

This policy applies to all personal data we collect from:

• Visitors to our website (move2europe.eu)
• Clients who use our relocation consultancy services
• Candidates whose data we process for job placement purposes
• Business contacts and partners
• Individuals who contact us via email, phone, or social media

Where we rely on legitimate interest as a legal basis, we have carefully assessed that our interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interest at any time.

5. Sensitive Data

In the course of our relocation services, we process nationality and immigration data, which is ordinary personal data. However, identification documents and visa applications may indirectly reveal racial or ethnic origin. Where this occurs, we process such data only when strictly necessary for service delivery, based on your explicit consent (Art. 9(2)(a) GDPR) and where necessary for carrying out obligations in the field of employment law (Art. 9(2)(b) GDPR). We do not process health data, biometric data, or data concerning religious beliefs, political opinions, or sexual orientation.

We never sell your personal data to third parties. Data sharing is always limited to the minimum necessary for the specific purpose. All third-party processors are bound by GDPR-compliant data processing agreements.

7. International Data Transfers

Your personal data may be transferred to countries outside the European Economic Area (EEA), in particular:

• United States — Our hosting provider Netlify, Inc. is based in the US. Transfers are protected under the EU-US Data Privacy Framework (DPF), under which Netlify is certified. As an additional safeguard, Standard Contractual Clauses (SCCs) approved by the European Commission are also in place.
• United Kingdom — Our payment processor Wise Payments Limited is based in the UK. The European Commission has granted the UK an adequacy decision, and Wise also operates under Standard Contractual Clauses.
• Employer locations worldwide — When we submit your application to employers outside the EEA, we do so only with your explicit consent (Art. 49(1)(a) GDPR). Before such transfers, we will inform you of the destination country and any risks arising from the absence of an adequacy decision or appropriate safeguards in that country.

You may request a copy of the safeguards in place for international transfers by contacting privacy@move2europe.eu.

When the retention period expires, your personal data is permanently deleted or anonymized. We conduct periodic reviews to ensure data is not retained longer than necessary.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15) — Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — Request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17) — Request deletion of your personal data ("right to be forgotten").
• Right to restriction (Art. 18) — Request that we limit how we process your data.
• Right to data portability (Art. 20) — Receive your data in a structured, machine-readable format.
• Right to object (Art. 21) — Object to processing based on legitimate interest or for direct marketing.
• Right to withdraw consent (Art. 7(3)) — Withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Right regarding automated decisions (Art. 22) — Not to be subject to automated decision-making with legal or significant effects (see Section 10).
• Right to lodge a complaint (Art. 77) — With the Estonian Data Protection Inspectorate or your local supervisory authority (see Section 18).

To exercise any of these rights, contact us at privacy@move2europe.eu or by post to our registered address. We will respond within one month. This period may be extended by two further months for complex requests, in which case we will inform you. Exercising your rights is free of charge.

10. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you. All decisions regarding your job placement and relocation are made by our team personally. Where AI tools assist in our work (see Section 11), all outputs are reviewed and confirmed by a human team member before any action is taken.

11. Cookies & Tracking

Our website uses the following types of cookies:

• Strictly necessary cookies — required for the website to function. These do not require your consent under the ePrivacy Directive (2002/58/EC) and, for users in Germany, Section 25 TDDDG.
• Analytics cookies (Google Analytics 4) — we use Google Analytics 4, provided by Google Ireland Limited, to understand how visitors interact with our website. GA4 collects data such as pages visited, time on site, and approximate location (country/city level). This data is used solely to improve our website and services. Legal basis: Art. 6(1)(a) GDPR (your opt-in consent). Analytics cookies are only loaded after you have accepted cookies via the consent banner on our website. You can withdraw your consent at any time by clearing your browser's local storage or cookies.

You can opt out of Google Analytics at any time by installing the Google Analytics Opt-out Browser Add-on.

Fonts: We self-host all web fonts (Outfit, Plus Jakarta Sans) on our own servers. No data is transmitted to Google or other third-party font providers when you visit our website.

12. Use of Artificial Intelligence

We use artificial intelligence (AI) tools to support our services and operations in the following areas:

• Content creation — AI tools assist in drafting and editing blog articles, guides, and other written materials published on our website.
• CV review and optimization — AI tools support our team in reviewing and improving candidate CVs, LinkedIn profiles, and cover letters as part of our service delivery.
• Job matching — AI tools assist our team in identifying job opportunities and assessing their fit with a candidate's profile, skills, and relocation goals.
• Internal operations — AI tools are used internally to assist with drafting correspondence, summarizing information, and other operational tasks.

Personal data — such as your name, professional background, CV, and work history — may be processed by AI tools in the course of service delivery. We ensure that:

• All AI-assisted outputs are reviewed and confirmed by a human team member before any action is taken.
• No fully automated decisions with legal or significant effects are made about you (see Section 10).
• AI service providers are selected carefully and bound by appropriate data processing agreements.

Legal basis for AI-assisted processing: Art. 6(1)(b) GDPR (performance of contract) for client and candidate data; Art. 6(1)(f) GDPR (legitimate interest) for content creation and internal operations.

We may embed content from third-party services (such as YouTube videos or Google Maps) on certain pages. These services may collect data about your interactions with their content. We recommend reviewing their respective privacy policies.

This section will be updated if we add new third-party services (such as analytics or chat tools).

14. Security Measures

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (SSL/TLS)
• Access controls limiting data access to authorized personnel only
• Secure storage of documents within the European Union
• Contractual data protection obligations for all freelancers and subcontractors
• Regular review of security practices

Despite our best efforts, no method of transmission over the internet is 100% secure. If you have reason to believe your data has been compromised, please contact us immediately.

15. Data Breaches

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) within 72 hours
• Inform affected individuals without undue delay if the breach poses a high risk
• Take immediate steps to contain and mitigate the breach

16. Obligation to Provide Data

To enter into a service agreement with us, you must provide your name, contact details, and professional information. Without this data, we are unable to deliver our services. For website visitors, no personal data beyond what is automatically collected (server logs) is required.

17. Children

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a person under 18, we will delete it immediately.

18. Recruitment & Job Placement

As a relocation consultancy, we act as an intermediary between candidates and potential employers. The following applies specifically to candidate data:

• Your CV and professional details are only shared with a specific employer with your prior knowledge and consent.
• You may withdraw from our candidate pool at any time by contacting us.
• Once your data has been shared with an employer, that employer becomes an independent data controller for the data they have received. We are not responsible for how they process it after that point.
• If we obtain your data from a source other than you (e.g., a referral or LinkedIn), we will contact you directly within one month, informing you of: the specific source of your data, the categories of data obtained, the purposes and legal basis of processing, and all information required under Art. 14 GDPR.

You have the right to lodge a complaint with the Estonian Data Protection Inspectorate or, if you reside in another EU member state, with the supervisory authority in your country of residence.

20. Changes to This Policy

We may update this privacy policy to reflect changes in our services, legal requirements, or data processing practices. Material changes will be communicated via our website and, for existing clients and candidates, by email. We encourage you to review this page periodically.