Your GDPR Rights

ShotgunCV is committed to protecting your personal data under the General Data Protection Regulation (GDPR). As a Danish company operating within the EU, we fully comply with GDPR requirements.

This page explains your rights and how to exercise them.

You have the right to request a copy of all personal data we hold about you. This includes your profile information, CV data, campaign history, cover letters generated, and application outcomes.

We will respond to access requests within 30 days.

If any of your personal data is inaccurate or incomplete, you have the right to have it corrected. You can update most information directly in your dashboard, or contact us for changes you cannot make yourself.

You have the right to request deletion of your personal data ("right to be forgotten"). When you request deletion, we will:

• Delete your account and profile
• Delete your uploaded CV and parsed CV data
• Delete your personal bio and preferences
• Delete all generated cover letters
• Delete campaign and application records
• Remove your data from all third-party processors

Exceptions: We may retain certain data where required by law (e.g., payment records for tax compliance, retained for up to 5 years under Danish bookkeeping law). Anonymised, aggregated data that cannot identify you is also retained.

Deletion is completed within 30 days of your request.

You have the right to receive your personal data in a structured, commonly used, machine-readable format (JSON). This includes:

• Your profile information
• Your CV data (both original file and parsed data)
• Your campaign history and application records
• All generated cover letters
• Reply data and interview invites

We will provide your data export within 30 days.

You can request that we temporarily stop processing your data while a concern is being resolved — for example, if you believe your data is inaccurate or you have objected to processing.

You can object to processing based on legitimate interest at any time. If you object, we will stop processing unless we can demonstrate compelling legitimate grounds.

Where processing is based on consent (e.g., marketing emails), you can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

The following third-party processors handle your data on our behalf. Each has a Data Processing Agreement (DPA) or equivalent safeguard in place.

SCC = EU Standard Contractual Clauses under GDPR Art. 46(2)(c).

If you believe we are not handling your data correctly, you have the right to lodge a complaint with the Danish Data Protection Agency:

• Datatilsynet
• Carl Jacobsens Vej 35, 2500 Valby, Denmark
• Email: dt@datatilsynet.dk