Digger

GDPR overview

GDPR compliance is claimed explicitly and repeatedly: badges reading “GDPR Compliant” and “GDPR by Design” appear across the site, and the homepage states Digger was “built GDPR-first from day one”. The privacy policy, last updated in March 2026, lists the rights available: access, rectification, erasure, restriction, portability, objection and withdrawal of consent, with a 30-day response commitment. All requests go through a single address, hello@digger.hr. Candidates may write directly to Digger even though its customers are the controllers, and export and deletion tools are provided in the platform. Data minimisation, purpose limitation and consent management are described as architectural principles, and breaches are notified to affected parties within 72 hours. As an EU-established company, Digger needs no Article 27 representative. Missing, however: no DPA, no sub-processor list and no named DPO.

Who owns the data?

Digger's terms are explicit on ownership: the customer keeps ownership of everything uploaded to the platform, and the publisher claims no ownership over candidate data, job descriptions or other content. The customer grants Digger a limited licence to process that data for the sole purpose of providing the service, and nothing beyond it. Under GDPR the roles are split accordingly: Digger's customers act as data controllers for candidate data and are responsible for answering candidate requests, while the publisher processes on their behalf. Deleting the account triggers deletion of the associated data under the privacy policy. No sub-processor list is published, so the parties actually handling the data are not named.

Reuse rights

Customers keep full use of the data they upload and can reuse, export and delete it without asking the publisher for permission: export and deletion tools are built into the platform, and data stays exportable for 30 days after cancellation. On its side, Digger collects account information (name, email, company), uploaded candidate data (CVs, profiles, notes), usage data and technical data such as IP address, browser and device. The stated purposes are delivering and improving the platform, running AI matching and analysis, communicating about the account, securing the service against abuse and meeting legal obligations, with AI processing kept on EU-hosted infrastructure. The privacy policy states that data is never sold to third parties and that candidate data is never used for advertising. On model training the wording is narrow and should be read literally: “We do not use candidate data to train general-purpose AI models. Processing is limited to the specific recruitment context of each customer.” The commitment targets general-purpose models specifically and says nothing about any internal model. Cookies are limited to essential and analytics, with an opt-out and no advertising or tracking cookies.

Data retention & training

Hosting summary

Digger states without qualification that all data is stored in EU data centres, and its security page goes further: “No candidate data leaves the European Union, ever.” The homepage adds that the product is developed and hosted in Belgium, a claim repeated in footer badges on every page (“EU Hosted”, “EU Data Centers”, “Belgium”), and AI processing is described as running entirely on that EU-hosted infrastructure. Protection measures are documented with some precision: AES-256 encryption at rest, TLS 1.3 in transit, encrypted backups, role-based access control, MFA on administrative actions, and restricted, logged access to production systems, with breach notification to affected parties within 72 hours. Two things remain undocumented. The cloud providers are never named, being described only as industry-leading and credited with SOC 2 and ISO 27001 certifications, which therefore belong to those providers rather than to Digger. And no data centre location is given beyond the country, nor any sub-processor list, so the EU-only claim cannot be verified from outside the site.