Privacy Policy
Last updated: 25 October 2026
This policy explains what personal data GreenCareerBoard.com collects, why, and what you can do about it. It describes what the site does today, not what it may do in future — if our processing changes, this page changes first.
The data controller is The operator of GreenCareerBoard.com. For any question about this policy, or to exercise the rights described below, contact privacy@greencareerboard.com.
1. What we collect, and why
| Data | When | Why | Legal basis |
|---|---|---|---|
| Company name, contact email address, optional company website, and the content of the job listing | When an employer submits a job listing | To review the listing before publication and to contact the employer about it | Performance of a contract and our legitimate interest in operating a moderated job board |
| Email address and preferred language | When you subscribe to the newsletter | To send renewable energy job updates you asked for | Your consent |
| Email address, the search you saved (sector, location and filters) and preferred language | When you create a job alert | To email you new jobs that match that search | Your consent |
| Email address, and the listings and payments linked to your account | When an employer signs in to the employer dashboard | To let employers manage their own listings and buy paid upgrades | Performance of a contract |
| Email address, the jobs you save or mark as applied (with the date), and the sectors and countries you choose as preferences | When you create a job-seeker account and use it | To keep your saved jobs, applications and preferences, and to let you manage your job alerts in one place | Performance of a contract (the account you asked for) |
| Name, email address, subject and message | When you use the contact form | To read and reply to your message | Our legitimate interest in responding to enquiries |
| IP address and browser user-agent | On every request, in short-lived server logs. For rate limiting we keep only a one-way hash of the address with a request count, for at most one day | To keep the site available, and to rate-limit submissions and sign-in attempts so the site is not abused | Our legitimate interest in the security and integrity of the service |
That is the complete list. We do not ask for, or store, CVs, dates of birth, national identifiers or any special category data. Card details are entered on Stripe's own payment page and never reach us; we receive only whether the payment succeeded.
2. What is published, and what is not
When a job listing is approved, the listing itself becomes public: the company name, job description, location, salary range if provided, and the application link. Search engines can index it.
The employer contact email address is never displayed on a public page. It is visible only to the site operator inside the password-protected review console, and is used to correspond about the listing.
Some listings come from employers' public careers pages rather than being submitted to us. From those we publish only facts — the job title, employer name, location, contract type and the link to the employer's own page — with a one-line summary we write ourselves. They contain no personal data: we do not copy recruiters' names or contact details. An employer can ask us to remove its listings at any time by writing to privacy@greencareerboard.com.
We count how many times each job's Apply button is pressed each day, to show employers how a listing performs. The count records nothing about who pressed it.
What you save or mark as applied in a job-seeker account is never shown to employers. An employer sees only how many job seekers saved one of its own listings, and only once that number is three or more, so it cannot point to any one person.
Newsletter addresses and contact form messages are never published, and are not shared with employers or any third party beyond the processors listed in section 5, who act only on our instructions to run the service.
3. Job seekers
You do not need an account to browse or search jobs, or to create a job alert. If you choose to create one, it holds only your email address, the jobs you saved or marked as applied, and your sector and country preferences. There is no profile, no CV and nothing an employer can look up. Your job alerts are linked to your email address, so alerts you created before signing up appear in your account.
Applications are not handled by this site: the apply link takes you to the employer's own website, and anything you submit there is governed by that employer's privacy policy, not this one. Marking a job as applied only records that fact and the date in your account; nothing is sent to the employer.
4. Cookies and tracking
We use Vercel Analytics to see aggregate visit counts and which pages are popular. It sets no cookie, uses no persistent identifier, and cannot be used to recognise you individually or across other websites, so it requires no consent. We load no advertising or social media tracking scripts. Browsing sets a single functional cookie, NEXT_LOCALE, which stores nothing but the language you are reading in (en or pt) and expires when you close your browser. A second cookie, gcb_admin, is created only when the site operator signs in to the administration console; it is strictly necessary, holds no personal data, and cannot be read by JavaScript. When you sign in to an account, job seeker or employer, our database provider Supabase sets a session cookie (sb-…-auth-token) that keeps you signed in; it is strictly necessary for the account to work and is removed when you sign out. The Cookie Policy lists these cookies in full.
If we introduce analytics that does set a cookie or use a persistent identifier, such as Google Analytics, we will ask for your consent first, and the Cookie Policy will be updated to describe it.
5. Who processes your data on our behalf
- Supabase — hosts the database in which the data above is stored, in the European Union.
- Vercel — hosts and serves the website, produces the short-lived request logs described above, and provides the cookie-free analytics described in section 4.
- Resend — delivers the newsletter and job-alert emails.
- Stripe — processes card payments for paid listings. For the payment data it collects itself, Stripe acts as an independent controller under its own privacy policy.
- GitHub — runs our scheduled tasks, such as sending job alerts, which read the email addresses involved while they run.
All are contractually bound to process data only on our instructions. All are companies with United States parent entities, so some processing or support access may take place outside the European Economic Area; where that happens it is covered by the European Commission's Standard Contractual Clauses.
We do not sell personal data, we do not share it for advertising, and we do not use it to build profiles or to make automated decisions about you.
6. How long we keep it
- Job listings and the associated employer contact details: for as long as the listing is published, and afterwards for as long as needed to keep a record of what was published and to handle any dispute.
- Newsletter subscriptions and job alerts: until you unsubscribe or ask us to delete the address.
- Employer accounts: for as long as the account is used, and payment records for as long as tax law requires.
- Job-seeker accounts: until you delete the account, which you can do yourself on the My account page. Deleting it removes, at once, the account, your saved and applied jobs, your preferences, your job alerts and your newsletter subscription.
- Rate-limit hashes: one day.
- Contact form messages: until the enquiry is resolved and any follow-up period has passed.
- Server logs: retained by our hosting provider for a short, limited period and then discarded.
7. Your rights
Under the General Data Protection Regulation you have the right to:
- ask what personal data we hold about you, and receive a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to our processing;
- receive your data in a portable format;
- withdraw consent at any time, where processing is based on consent — withdrawing it does not affect processing already carried out.
Write to privacy@greencareerboard.com and we will respond within one month. Every newsletter email includes a one-click unsubscribe link that removes your address immediately, and a job-seeker account can be deleted, with everything in it, from the My account page — you do not need to contact us for either.
If you believe we have handled your data unlawfully you may complain to your national supervisory authority. In Portugal that is the Comissão Nacional de Proteção de Dados (CNPD), https://www.cnpd.pt/.
8. Security
The site is served only over HTTPS. The database enforces row-level security so that unapproved listings are not readable by the public. Submissions and administrator sign-in attempts are rate-limited. The administrator password is stored only as a salted hash, never in plain text.
No system is perfectly secure. If a breach ever affects your personal data and is likely to present a risk to you, we will notify the supervisory authority within 72 hours and inform you where the law requires it.
9. Children
This site is intended for people seeking or advertising professional employment and is not directed at children. We do not knowingly collect data from anyone under 16.
10. Changes
If this policy changes materially we will update the date at the top of this page. Where the change affects processing based on your consent, we will ask for consent again rather than rely on the old one.