Privacy policy

1. Data controller

Bluecrew AS (org. no. 936 463 843) is the data controller for personal data collected through bluecrew.no and in connection with our staffing services.

Contact details: Email: post@bluecrew.no Phone: +47 77 02 90 00 Address: Storgata 11, 9405 Harstad, Norway

2. What data we collect

We collect the following categories of personal data:

For candidates: Contact details (name, email, phone, address) National identity number (for identity verification) CV and work experience Certificates and qualifications (STCW, medical certificate, etc.) References from previous employers Profile photo (optional)

For operators and clients: Contact details for contact persons Company information Crewing requirements and position details

Technical data: IP address Browser type and device information Cookies

3. Purposes of processing

We process personal data for the following purposes:

Recruitment and staffing: matching qualified candidates with relevant positions at our clients Verification: confirming identity and validating certificates and qualifications Communication: contacting you about relevant job offers, updates and follow-up Contract fulfilment: meeting our obligations towards candidates and clients Service improvement: analysing and improving our services and user experience Legal requirements: fulfilling legal obligations (accounting, the Working Environment Act, etc.)

4. Legal basis

We process personal data on the following legal bases under the GDPR:

Consent (Art. 6(1)(a)): when you register and accept our privacy policy Contract (Art. 6(1)(b)): where necessary to fulfil an agreement with you as a candidate or client Legal obligation (Art. 6(1)(c)): where we are required by law to process data Legitimate interest (Art. 6(1)(f)): to improve our services and prevent fraud

5. Sharing of data

We share personal data with the following parties:

Clients: When you apply for or are matched with a position, we share relevant information (CV, certificates, contact details) with the operators and employers in question.

Service providers: Supabase (database and authentication) Resend (email delivery) Digital identity verification Vercel (hosting) Google Ads (marketing, only with consent) Meta/Facebook (marketing, only with consent)

Authorities: We disclose data to authorities when legally required to do so.

AI systems and public content: Bluecrew makes public company information available to AI search engines and language models (such as ChatGPT, Claude, Perplexity and Google Gemini) through the files /llms.txt and /llms-full.txt. These files contain only company information, service descriptions, general salary overviews and career guidance. They never contain personal data about candidates or employees.

Personal pages (profile, applications, registration, data deletion) are actively blocked from all AI crawlers through robots.txt and noindex directives. AI systems have no access to candidate profiles, CVs, certificates or other personal information.

Legal basis for sharing public company content with AI systems: legitimate interest (GDPR Art. 6(1)(f)), to increase the visibility of our services and career guidance.

We never sell personal data to third parties.

6. Storage and deletion

Retention periods: Active candidate profiles: for as long as you are registered and the profile is active Inactive profiles: deleted automatically after 24 months without activity Applications: stored for 12 months after the process has ended Accounting data: 5 years, as required by the Norwegian Bookkeeping Act Communication logs: 3 years

Deletion: You can request deletion of your profile and associated data at any time. Requests are answered within 30 days.

7. Your rights

Under the GDPR you have the following rights:

Access: the right to know what data we hold about you Rectification: the right to have inaccurate data corrected Erasure: the right to request deletion of your data Restriction: the right to restrict the processing of your data Data portability: the right to receive your data in a structured format Objection: the right to object to processing based on legitimate interest Withdrawal of consent: you can withdraw your consent at any time

How to exercise your rights: Data deletion: use our deletion form at bluecrew.no/slett-data (in Norwegian) Other requests: contact us at post@bluecrew.no Response time: within 30 days

8. Cookies

We use the following types of cookies:

Necessary cookies: Session handling Security (CSRF protection) User preferences (such as cookie consent)

Analytics: Plausible Analytics (privacy-friendly, no personal data, no cookies)

Marketing cookies (require consent): Google Ads, to measure the effectiveness of ad campaigns Meta Pixel (Facebook), to track conversions and target ads

Marketing cookies are only set if you give consent through our cookie banner. You can change your consent at any time by deleting cookies in your browser and reloading the page.

9. Security

We take security seriously and have implemented the following measures:

Encryption of data in transit (TLS/SSL) Encryption of sensitive data in the database Digital identity verification Access control and logging Regular security assessments ISO 9001 certification (being implemented)

If you suspect a security breach, contact us immediately at post@bluecrew.no.

10. Changes to this privacy policy

We reserve the right to update this privacy policy. In the event of material changes we will notify you by email or on the website.

Last updated: March 2026

11. Complaints to the Norwegian Data Protection Authority

If you believe we do not process your personal data in accordance with the regulations, you can complain to the Norwegian Data Protection Authority (Datatilsynet):

Website: datatilsynet.no Email: postkasse@datatilsynet.no Phone: +47 22 39 69 00