Your data, protected.

1. Who we are (Data Controller)

CV95 is operated by:

• Legal name: MB CDL Leads
• Trading name in the EU: CV95
• Registered address: Dariaus ir Girėno g. 9-6, Klaipėda, Lithuania
• Company registration number: 306293634
• VAT number: LT100020092519
• General privacy enquiries: privacy@cv95.com
• Data-subject rights requests: laurynas@cv95.eu

We act as the data controller of the personal data described in this Policy. We have not appointed a Data Protection Officer because we are not legally required to do so under Article 37 GDPR. The person responsible for handling privacy matters within CV95 is Laurynas, reachable at laurynas@cv95.eu.

We are established in the Republic of Lithuania. Our lead supervisory authority is the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, “VDAI”).

2. Scope of this Policy

This Policy applies to:

• the website cv95.eu (the “Website”); and
• the CV95 recruitment platform (the “Platform”).

We refer to the Website and the Platform together as our “Services”.

3. Who uses our Services

CV95 serves five categories of users, and this Policy applies to all of them:

• Drivers / Candidates — individuals applying for HGV / truck-driver jobs through CV95. We only accept drivers holding C and/or CE licence categories.
• Recruiters — recruitment-agency users using the Platform to manage candidates and post jobs.
• Transport companies / Employers — companies reviewing candidates and offering positions.
• Website Visitors — anyone browsing public pages or submitting a contact form.
• CV95 Staff — our internal personnel administering the Platform and recruitment activity.

4. Age restriction

Our Services are intended exclusively for individuals aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn that we have inadvertently collected data from a minor, we will delete it without delay. If you believe a minor has provided us with personal data, please contact us at privacy@cv95.com.

5. What personal data we collect

5.1 Data we collect from Drivers / Candidates

When you register as a driver or submit your details to CV95, we may collect:

• Identification: full name, date of birth, country of residence, nationality.
• Contact details: phone number, email address, postal address.
• Driving qualifications: driving-licence details, licence categories (C, CE), Code 95 / Driver CPC details, tachograph-card details, additional driver certificates (for example ADR).
• Professional history: work experience, previous employers, employment history, references.
• Preferences: preferred job type, country, rotation pattern, salary expectations.
• Documents: CV / résumé and other files you choose to upload.
• Application data: your answers to application questions and notes made by recruiters about your application.
• Communications: messages exchanged with us or with employers through email, SMS, WhatsApp, Telegram, Messenger, phone calls, and Platform notifications.

We deliberately limit what we collect. We do not request or store passport or national-ID copies, right-to-work documents, medical certificates, criminal-record extracts, or driver-violation records.

We do not seek “special categories” of personal data within the meaning of Article 9 GDPR (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation). If you voluntarily include such information in your CV, application, or communications, you are deemed to have given your explicit consent for us to process it as part of your application file, and we will handle it with the same level of protection as other data, until you ask us to remove it.

5.2 Data we collect from Recruiters and Companies

For recruitment-agency and transport-company users, we may collect:

• Company information: company name, registration details, country of establishment.
• Contact-person data: full name, job title, business email, business phone.
• Account data: login credentials, role and permissions, account activity logs.
• Job postings: job descriptions, hiring requirements, locations.
• Recruitment data: candidate feedback, notes about drivers, internal recruiter notes.
• Billing data: billing and invoice details, VAT number, contract details, payment records.
• Communications: emails, phone calls, and messages exchanged with our support team.

5.3 Data we collect automatically

When you visit our Website or use the Platform, we automatically collect:

• IP address and approximate location derived from it;
• device information (device type, operating system, browser type and version);
• usage data (pages visited, time spent, actions taken, referring URL);
• authentication and security logs (login attempts, session identifiers);
• cookie data and similar tracking-technology identifiers.

See Section 11 (Cookies and Tracking) for details.

5.4 Data we collect from third parties

We may receive personal data about Drivers from recruiters or partners who have your consent (or another lawful basis) to share it with us, and from publicly available professional sources where this is necessary to verify qualifications you have stated.

6. How we use your personal data (Purposes)

We process personal data for the following purposes:

• Creating and managing accounts — registering drivers, recruiters, and companies on the Platform; managing user profiles and login credentials.
• Processing job applications — receiving, organising, and tracking applications submitted through CV95.
• Matching drivers and employers — using the data drivers provide to suggest relevant job opportunities, and to surface matching candidates to employers.
• Enabling communication — letting recruiters contact candidates, and letting employers reach suitable applicants, through the communication channels described in Section 12.
• Verifying qualifications — confirming licence categories, work history, and right-to-work information where relevant for a role.
• Sending service messages — emails, SMS, WhatsApp, Telegram, Messenger, and in-Platform notifications about your account, your applications, and matched opportunities.
• Managing client accounts — administering recruiter and employer accounts, including billing, invoicing, and contract management.
• Improving the Service — analysing how the Website and Platform are used to fix bugs, develop features, and improve user experience.
• Security and fraud prevention — protecting CV95, our users, and our partners against fraud, misuse, unauthorised access, and other security threats.
• Legal compliance — meeting our obligations under Lithuanian, EU, and other applicable law (accounting, tax, anti-money-laundering, lawful requests from public authorities).
• Marketing and service updates — sending newsletters, job alerts, and information about our Services where you have agreed to receive them (see Section 12).

7. Legal bases for processing (Article 6 GDPR)

We rely on the following legal bases under Article 6 GDPR:

Creating and managing your account; providing platform services to logged-in users

Performance of a contract — Art. 6(1)(b)

Processing job applications you submit

Performance of a contract / pre-contractual steps at your request — Art. 6(1)(b)

Sharing your application with the specific employer or recruiter you choose to apply to

Performance of a contract / pre-contractual steps at your request — Art. 6(1)(b)

Matching drivers with general employer opportunities; recommending jobs

Legitimate interest in operating an effective recruitment platform — Art. 6(1)(f)

Sending newsletters, job alerts, and marketing messages

Your consent — Art. 6(1)(a)

Sending essential service messages (account, application status)

Performance of a contract — Art. 6(1)(b)

Verifying qualifications and identity

Legitimate interest in offering trustworthy candidates to employers — Art. 6(1)(f)

Improving and analysing the Platform

Legitimate interest in service development — Art. 6(1)(f)

Fraud prevention and platform security

Legitimate interest in protecting our service and users — Art. 6(1)(f)

Accounting, tax, and other regulated records

Legal obligation — Art. 6(1)(c)

Responding to lawful requests from public authorities

Legal obligation — Art. 6(1)(c)

Where we rely on legitimate interest, we have carried out a balancing assessment to ensure that our interest is not overridden by your interests, rights, or freedoms. You can ask us about this assessment by contacting laurynas@cv95.eu.

Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

8. Automated processing and profiling

We currently use the following forms of automated processing:

• Driving-licence scanning (OCR). When a driver registers, we use an AI-based tool to scan the image of the driving licence you upload and to extract data fields (such as name, licence number, categories, and expiry date) in order to pre-fill the registration form. This is performed solely to spare you the effort of typing in details by hand. A human always reviews and confirms the extracted data. We do not make any decision about your application, eligibility, or job suitability on the basis of this extraction.
• Job matching. We use rule-based matching to suggest jobs to drivers and to surface candidates to employers, based on the licence categories, location preferences, and other criteria you provide. This is decision-support only — humans (recruiters, employers, or you) take the actual decisions about applications, contacts, and hires.

We do not carry out automated decision-making with legal or similarly significant effects on you, as defined in Article 22 GDPR. We do not automatically reject, approve, score, or rank candidates without human involvement.

If in the future we introduce more advanced AI features that could amount to automated decision-making under Article 22 GDPR, we will update this Policy and, where required, ask for your consent or implement appropriate safeguards (such as the right to obtain human intervention, to express your point of view, and to contest the decision).

9. How we share your personal data

We share personal data only where there is a clear purpose and a lawful basis. We do not sell personal data, and we will never share one client’s data with another client.

9.1 Driver data — only at your direction

A driver’s profile and application materials are shared with a specific employer or recruiter only when the driver chooses to apply to that company through CV95. We do not push driver profiles to companies without the driver’s deliberate action.

When you apply to a company through CV95:

• the employer or recruiting agency receives a copy of your application materials and contact details;
• they become a separate, independent data controller of that data for their own recruitment purposes;
• their handling of your data is governed by their own privacy policy, not this one;
• they may decide independently how long to keep your data, which of their staff may see it, and whether to contact you about other opportunities they have.

We require employers and recruiters using CV95 to use candidate data only for legitimate recruitment purposes, and not to share it onward without an appropriate lawful basis, but we do not control their internal processing once data has been transferred to them.

9.2 Categories of recipients

We share personal data with the following categories of third parties:

• Transport companies and employers — only when a driver chooses to apply to them (see 9.1).
• Recruitment agencies — same as above.
• CV95 staff and internal recruiters — on a need-to-know basis under role-based access controls.
• Hosting and infrastructure providers — to host the Platform and store data.
• Email, SMS, and messaging providers — to deliver communications through the channels listed in Section 12 (including WhatsApp Business, Telegram, Messenger, SMS gateways, and email-delivery providers).
• Analytics, advertising, and marketing-tool providers — including Google Analytics, Google Ads, Microsoft Ads, Meta Pixel, LinkedIn Insight Tag, and session-recording / behaviour-analytics tools such as Hotjar and/or Microsoft Clarity.
• Payment and accounting providers — to process payments and keep financial records.
• Professional advisors — accountants, auditors, and lawyers where reasonably necessary.
• Public authorities — where we are legally required to disclose information (for example, tax authorities, courts, and law-enforcement bodies following a lawful request).

All processors we use act on our documented instructions under a written data-processing agreement that meets the requirements of Article 28 GDPR.

9.3 Corporate transactions

If CV95 is involved in a merger, acquisition, sale of assets, restructuring, or insolvency, personal data may be transferred to the acquiring party as part of that transaction. Where reasonably possible, we will let you know in advance and explain your options.

10. International data transfers

CV95 operates primarily within the European Union and primarily targets EU member states and, to a lesser extent, the United Kingdom. Personal data is stored on servers located within the European Economic Area (“EEA”).

We do not share driver or candidate application data with companies located in the United States.

However, some of the technical service providers we use — for example, providers of analytics, advertising, messaging, and customer-engagement tools such as Google, Meta, Microsoft, LinkedIn, Hotjar / Microsoft Clarity, and WhatsApp Business — are based in the United States or may transfer data to the United States as part of their global operations. Where this occurs:

• we rely on the EU–US Data Privacy Framework (“DPF”) where the provider is certified under it; or
• we use the European Commission’s Standard Contractual Clauses (“SCCs”) together with appropriate supplementary measures.

Where required, we carry out a transfer impact assessment to verify that the level of protection is essentially equivalent to that guaranteed within the EEA. You can ask us for more information about the safeguards in place by contacting laurynas@cv95.eu.

11. Cookies and tracking

The Website uses cookies and similar tracking technologies. We use:

• Strictly necessary cookies — required to make the Website and Platform work (login, security, basic functionality). These do not require your consent.
• Analytics cookies — including Google Analytics, to help us understand how the Website is used.
• Marketing and advertising cookies — including Google Ads remarketing, Microsoft Ads, Meta Pixel, and LinkedIn Insight Tag.
• Session-replay and behaviour-analytics cookies — including Hotjar and/or Microsoft Clarity.

All non-essential cookies (analytics, marketing, session replay) are only set with your prior, freely given, specific, informed, and unambiguous consent, collected through our cookie-consent banner. You can withdraw your consent at any time through the cookie-settings link on the Website.

A full list of cookies used, their purpose, and their retention period is set out in our separate Cookie Policy.

12. Communications and marketing

12.1 Communication channels

For drivers and candidates registered on CV95, we use the following communication channels to deliver application updates, matched opportunities, and other service-related messages:

• email;
• phone calls;
• SMS;
• WhatsApp;
• Telegram;
• Messenger; and
• in-Platform notifications.

The lawful basis for these service messages is the performance of our recruitment service to you (Article 6(1)(b) GDPR). You can opt out of any specific channel (other than essential platform notifications) by updating your account preferences or contacting us at privacy@cv95.com.

We do not share mobile or messaging-channel information with third parties for marketing or promotional purposes. Sharing with our service providers (for example, our SMS or WhatsApp Business provider) takes place only to the extent necessary to deliver the message to you.

12.2 Marketing

If you opt in, we may send you:

• job alerts matching your stated preferences (by email, SMS, or WhatsApp);
• newsletters about CV95 and the trucking-recruitment market;
• service updates about new features or changes to the Platform.

Marketing is strictly opt-in. We will only send you marketing if you tick the consent box during registration or in your account settings.

You can unsubscribe at any time by:

• clicking the “unsubscribe” link in any email;
• replying STOP to any SMS or WhatsApp message;
• changing the preferences in your CV95 account;
• emailing us at privacy@cv95.com.

Withdrawal does not affect any marketing already sent before we receive your request. We do not use your personal data for marketing by third parties.

13. How long we keep your data (Retention)

We keep personal data only for as long as necessary for the purposes for which it was collected, taking into account applicable legal requirements.

Active driver / candidate profile

While your account is active. An account is treated as inactive if there is no login or activity for 24 months.

Inactive driver / candidate profile

2 years from your last login or activity, then deleted unless you reactivate.

Unsuccessful application data

24 months from application date, unless you request earlier deletion.

Client / employer / recruiter account data

While the account is active. After closure, retained for up to 6 years for accounting and legal-defence purposes.

Billing, accounting, and tax records

10 years from the end of the relevant financial year, in accordance with Lithuanian accounting law.

Communications with our support team

1 year from the end of the conversation.

Marketing contact data (consent-based)

Until you withdraw consent or unsubscribe; then deleted from active marketing systems within 30 days.

Website analytics data

According to the analytics provider’s settings (typically up to 14 months).

Cookie data

As specified in the Cookie Policy (typically up to 24 months).

Security and access logs

12 months.

Where a specific period cannot be determined in advance, we apply the following criteria: (a) the duration of our relationship with you; (b) any legal obligation to which we are subject; (c) the existence of any actual or potential dispute, claim, or legal proceeding.

You may always ask us to delete your data earlier — see Section 14 (Your rights).

14. Your rights under the GDPR

As a data subject, you have the following rights under the GDPR and the Lithuanian Law on Legal Protection of Personal Data:

• Right of access (Art. 15) — to obtain confirmation of whether we process your personal data and, if so, a copy of that data and information about our processing.
• Right to rectification (Art. 16) — to have inaccurate data corrected and incomplete data completed.
• Right to erasure / “right to be forgotten” (Art. 17) — to have your data deleted in certain circumstances.
• Right to restriction of processing (Art. 18) — to ask us to limit how we use your data in certain circumstances.
• Right to data portability (Art. 20) — to receive your data in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible.
• Right to object (Art. 21) — to object to processing based on legitimate interest, including profiling, and to direct-marketing processing at any time.
• Right to withdraw consent (Art. 7(3)) — to withdraw your consent at any time, without affecting the lawfulness of past processing.
• Rights related to automated decision-making (Art. 22) — we do not currently carry out automated decision-making with legal or similarly significant effects; if this changes, you will have specific rights to obtain human review and to contest such decisions.

14.1 How to exercise your rights

To exercise any of these rights, contact us at laurynas@cv95.eu (preferred) or privacy@cv95.com.

We may ask you to verify your identity before responding (for example, by asking you to confirm details we already hold). We will respond within 30 calendar days of receiving your request. In complex cases, we may extend this period by up to two further months, in which case we will let you know within the original 30 days and explain why.

There is no fee for exercising your rights, except where a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act, as permitted by Article 12(5) GDPR.

14.2 Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

Our lead supervisory authority is the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija — VDAI):

• Address: L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania
• Phone: +370 5 271 2804
• Email: ada@ada.lt
• Website: vdai.lrv.lt

We would, however, appreciate the chance to address your concerns directly before you approach the supervisory authority — please contact us first.

15. How we protect your data (Security)

We have implemented appropriate technical and organisational measures to safeguard your personal data, including:

• password-protected user accounts;
• role-based access controls so that only authorised personnel can access personal data;
• encryption of data in transit using TLS / HTTPS;
• encrypted hosting and secure file storage;
• regular backups stored securely;
• activity and access logs;
• two-factor authentication for staff and, where supported, for users;
• restricted physical and remote access to our systems;
• staff training on data-protection obligations and confidentiality;
• written data-processing agreements with all our processors.

Despite our best efforts, no system can be guaranteed entirely secure. You also have a role in protecting your data — please keep your login details confidential and notify us immediately at privacy@cv95.com if you suspect unauthorised access to your account.

In the unlikely event of a personal-data breach likely to result in a high risk to your rights and freedoms, we will notify you and the supervisory authority in accordance with Articles 33 and 34 GDPR.

16. Third-party links

The Website and Platform may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to read the privacy policy of every site you visit.

17. Changes to this Privacy Policy

We may update this Policy from time to time. The “Effective date” at the top of this document shows when it was last revised.

For material changes (for example, changes to the categories of data we collect, the purposes we use it for, or the parties we share it with), we will notify you in advance by email or through a clear notice on the Website or Platform, and where the change requires your consent, we will ask for it.

Previous versions of this Policy are available on request from privacy@cv95.com.

18. Contact us

Questions about this Privacy Policy or our handling of your personal data:

• MB CDL Leads (trading as CV95)
• Dariaus ir Girėno g. 9-6, Klaipėda, Lithuania
• Company registration number: 306293634
• VAT: LT100020092519
• General privacy enquiries: privacy@cv95.com
• Data-subject rights requests: laurynas@cv95.eu
• Website: cv95.eu