Careers

Candidate Privacy Notice

Effective: June 3, 2026 · Last updated: August 28, 2026

This notice explains how Ludaxis OÜ(“Ludaxis,” “we,” “us”) collects and uses the personal data of people who apply for a role with us, and the rights you have under the EU General Data Protection Regulation (GDPR) and Estonian data-protection law. Ludaxis OÜ, based in Tallinn, Estonia, is the data controller for this processing.

It applies whenever you apply through our careers pages, by email, or otherwise share your details with us about a role. It does not cover ordinary use of our website or our games; see the Website Privacy Policy and the relevant game privacy notice.

1. What we collect

1.1 Information you give us

  • Identity & contact: your name and email address.
  • Application content: your CV/résumé, cover letter, and any portfolio or LinkedIn link you provide.
  • Anything else you choose to send in your application or correspondence with us.

1.2 Information from other sources

To assess your application we may review information about you that is already public — for example your LinkedIn or GitHub profile, personal site or portfolio, published work, press coverage, and app-store pages for titles you say you worked on. We collect this only to verify and contextualise the application you sent us; we do not build a profile of you for any other purpose.

2. How and why we use your data (legal bases)

  • To assess your suitability for the role and run our hiring process. Legal basis: our legitimate interest in recruiting suitable people (Art. 6(1)(f)) and, where relevant, taking steps at your request before entering a contract (Art. 6(1)(b)).
  • To communicate with you about your application. Legal basis: legitimate interest / pre-contract steps.
  • To keep brief records for a limited period in case of questions or disputes about the process. Legal basis: legitimate interest and legal compliance.

We ask you not to send us special-category data (e.g. health, religion, political views). If a CV contains such details we do not use them in assessing you.

3. AI-assisted screening & research

We use an AI assistant (DeepSeek) to help us review applications fairly and quickly. We send it extracted CV text and relevant application details. Specifically, it:

  • reads your CV and produces a short summary, a list of relevant skills, and a fit score against the role;
  • performs automated web research to find your public profiles and to check whether publicly-stated claims in your CV (e.g. employers, shipped titles, results) are supported by public sources — recording each as confirmed, unconfirmed, or contradicted, with links.

A human always decides.The AI output is a set of leads and a draft assessment for our team to review — it does not, on its own, reject or select candidates. No decision producing legal or similarly significant effects is made solely by automated means. The tool is designed to confirm it has found the right person before attributing anything, and an “unconfirmed” result simply means we could not find public evidence — it is not held against you.

If you do not want AI-assisted processing, apply by email to jobs@ludaxis.io and state that request before sending your application. If you have already applied, you can ask for a human to review any AI-assisted assessment, give your point of view, and contest a decision. Contact us using the details in Section 7.

4. Who we share it with

We do not sell your data. We share it only with service providers and platforms that help us run hiring, for the purposes listed below:

  • Vercel — website hosting and file storage for your CV.
  • Neon — the database that stores your application record.
  • DeepSeek — the AI service used for screening and public-profile research. Before sending applicant data, we document the applicable API contract, retention and deletion handling, and international-transfer safeguards.
  • Notion — our internal applicant-tracking board.
  • Telegram — internal notifications to our hiring team.
  • Resend — delivery of your application-confirmation email.

Some providers process data outside the European Economic Area. This may include the United States and, for DeepSeek, the People’s Republic of China. These transfers require a lawful transfer mechanism and appropriate safeguards under applicable law. You can contact us for information about the mechanism and safeguards relevant to your application.

5. How long we keep it

If we don’t hire you, we delete your application data within 6 months of the hiring decision, unless you ask us to keep it longer or we need it for a legal reason. If we hire you, your application becomes part of your employee record under a separate notice.

6. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you, and receive a copy;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict or object to our processing, including the AI-assisted research;
  • data portability;
  • not be subject to a decision based solely on automated processing (see Section 3);
  • lodge a complaint with a supervisory authority — in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).

To exercise any of these, contact us — we respond within 30 days.

7. Contact

8. Changes

We may update this notice. Material changes will be reflected in the “Last updated” date above.