Skip to content
PunaMatch Jobs that fit you.

Privacy policy

Last updated 8 September 2026

PunaMatch helps people in Kosovo find work. This page explains what we collect, why, how long we keep it, and what you can do about it. Where we could have collected something and chose not to, we say so.

  • If you match a CV without an account, the file is read and then deleted. We never keep it.
  • If you have an account, you decide whether we keep the file. It stays private either way.
  • Accounts have no passwords. We email you a single-use link instead.
  • Employers cannot find you unless you switch that on. It is off until you do.
  • Even then, an employer can only ask to connect. Your name, email and CV stay yours until you choose to share them.
  • We use no Google Analytics, no advertising pixels, and no third-party trackers.
  • Everything you can give us, you can delete.

Most listings on PunaMatch are collected from publicly available job adverts. We keep the listing text, the company, the location and the deadline, and every listing links back to where it came from. Employers can also post jobs directly and manage their own company page.

If you upload a CV, we read it in order to work out your skills, languages, level and experience.

  • The file is deleted immediately after it is read. We never keep it.
  • What remains is a short derived profile — a list of skills and a field of work. It is stored against a random token, not against you, and it expires automatically after thirty minutes.
  • Your results are private and are never indexed by search engines.
  • You can delete the profile at any time from the results page.

You can create an account with an email address and nothing else. There is no password: we email you a single-use link each time you sign in, and we store those links only as hashes, so we cannot read them back. One account can be used both as a person looking for work and as someone acting for a company.

While you are signed in we keep a session so you do not have to sign in again on every page. Signing out ends it immediately, and so does an administrator suspending the account.

If you choose to keep your CV in your account, the file is stored outside the public part of the website, under a name nobody can guess. It is not a public profile and there is no address anyone can visit to reach it.

  • From the file we derive a structured professional profile: field of work, level, years of experience, skills, languages and education.
  • Employers never receive the file itself simply because you appear in a search.
  • An employer can open your CV only after you have accepted their approach and chosen to share it. Access is checked again on every single request, so withdrawing it takes effect at once.
  • You can replace your CV or delete it, from your account, at any time.

If you ask for alerts, we store your email address, the derived profile described above, and your preferences. We do not store your name, your phone number, your address or your CV text — those fields do not exist in the alerts database.

  • We only start sending after you confirm the address by opening a link we email you.
  • Every email carries a one-click unsubscribe.
  • You can pause, unsubscribe, or delete the stored profile entirely from the link in any email.
  • Paid placement does not influence which jobs you are told about.
  • Asking for alerts does not make you discoverable by employers.

Saving a job needs no account: it is stored in your own browser and never sent to us, and clearing your browser data clears it. If you do have an account, you can ask us to copy that list into it so it follows you to another device — we only do that when you press the button.

Employers cannot search for you unless you turn discovery on yourself. It is off by default, and none of the following turns it on:

  • creating an account
  • uploading or storing a CV
  • saving jobs
  • subscribing to alerts

You turn it on with one switch in your account, and you can turn it off again the same way. Turning it off stops new employers finding you; it does not take back what you have already chosen to share with someone.

If you have turned discovery on, an employer with an account for a company we have verified can search for candidates by field, level, experience and skills, and see a limited professional summary of the people who fit.

  • They do not see your name, your email address, your phone number, your address, or your CV.
  • They see the derived professional facts — field of work, level, approximate experience, skills, languages, education, municipality — and why you matched.
  • When too few people match a search, we show nobody at all and no count either, so that narrowing a search cannot be used to work out who moved in or out of it.

We do not claim this makes you impossible to identify. A rare combination of profession, experience and location can point at one person even without a name, and no system can promise otherwise. What we can say is that we show the least we can, and that we suppress results rather than expose a small group.

An employer who has found your profile can ask to connect. That request reaches you, and nothing about you reaches them.

  • Expressing interest tells us to show you their message. It gives them no name, no email address, no phone number and no CV.
  • You see who they are and what the role is, and you can accept or decline. Declining is final, needs no reason, and tells them only that you declined.
  • Accepting is a separate decision. Accepting alone does not hand over your account: you share your verified email address so they can reach you — we say so before you confirm — and you choose separately whether to share your CV. It is not ticked for you.
  • We never share your phone number or your address with an employer.
  • You can block a company. A blocked company stops seeing your profile in searches, and anything still open between you is closed.
  • You can report an employer. What you write is read by a person reviewing the report and is never used for anything else.
  • An approach expires on its own if nobody acts on it, and companies are limited in how many people they may contact.

If you claim a company page or post a job, we store your name, your work email and the role you gave, so we can confirm the request is genuine and tell you what happened to it. Every claim is reviewed by a person before anyone is given control of a company page.

You are responsible for what you post and for what you do with candidate information. That means: the jobs you advertise are real and lawful, your listings are accurate, your hiring decisions are yours, and you meet the obligations the law places on employers.

  • Use candidate information only to consider that person for the role you approached them about.
  • Do not pass it to anyone outside your company, and do not add it to a marketing list or any other database.
  • Do not use PunaMatch to collect candidate data in bulk, and do not try to work around the limits and privacy controls described on this page.

We keep our own record of how the site is used — which pages are opened, which searches return nothing, whether a CV upload finished. We use it to keep the service working, to find faults, to understand what people need from it, and to notice abuse.

  • There is no Google Analytics, no advertising pixel, and no other third-party tracker. Nothing about your visit is sent to another company.
  • The identifiers we use are random values created in your browser. They are not derived from anything about you.
  • The events we record accept only a fixed list of numbers and short coded values. There is no field in which an email address, a name, a phone number or CV text could be stored.

We set as few as possible, and none of them track you:

  • a cookie remembering whether you chose Albanian or English
  • your light or dark theme choice, stored in your browser
  • a sign-in cookie, if you use an account, removed when you sign out

We use technical and organisational measures designed to protect the information we hold. Sign-in and confirmation links are single-use, expire quickly, and are stored only as hashes. Stored CVs sit outside the public part of the website. Employer access is checked against the database on every request, so withdrawing access takes effect immediately.

No online service can promise that information is completely secure, and we do not make that promise. If something goes wrong in a way that affects you, we will act on it and tell you what applicable law requires us to tell you.

Applications are not completed on PunaMatch. Many listings send you to the employer, or to another website where the advert was published, to apply. Once you leave, you are on a site we do not run: its own privacy practices and its own content apply, and we are not responsible for them beyond what the law requires.

Content that comes from employers

Job descriptions, company details and application instructions are supplied by employers or taken from where the advert was published. We do not write them and we cannot guarantee that every statement in them is complete, accurate or still current. If a listing looks wrong, treat the employer as the source of truth.

PunaMatch ranks and explains. It is a tool to help you decide where to look — nothing more.

  • A match is not a promise of a job, an interview, or a reply.
  • A high result does not mean you are suitable, and a low one does not mean you are not.
  • Candidates decide where to apply. Employers decide whom to hire. PunaMatch makes no hiring decision on an employer's behalf and takes no part in one.

The service may occasionally contain errors or out-of-date information, and it may be unavailable while we are working on it. To the maximum extent permitted by applicable law, it is provided as it is. Nothing on this page limits any liability or affects any right that cannot be limited or waived under the law that applies to you.

Please give accurate information about yourself and keep it current — a matching engine can only work with what it is told. And please do not do any of the following, which we act on when we find them:

  • signing in to, or trying to reach, an account that is not yours
  • presenting yourself as a company you do not represent
  • posting a job that is not a genuine, lawful vacancy
  • collecting candidate information in bulk, by any means
  • sending unsolicited messages using contact details obtained here
  • working around the privacy, rate or security controls described on this page

We aim to keep only what the service needs in order to work.

  • A CV matched without an account: deleted as soon as it has been read.
  • The derived profile from that match: thirty minutes.
  • Usage records: a limited period, ninety days by default, and then deleted.
  • Sign-in and confirmation links: minutes to a few days depending on what they are for, and single-use.
  • Your account, your stored CV, your profile, your alerts and your connections: until you delete them, or until we no longer need them for the service, for security, or to meet a legal obligation.

Most of what a data-protection request would ask for, you can do yourself, immediately, without asking us:

  • see the professional profile we derived from your CV, and correct the field of work if we read it wrongly
  • replace or delete your stored CV
  • turn employer discovery on or off
  • see every employer who has approached you, and exactly what you shared with each one
  • accept, decline, or stop sharing with an employer, and block a company
  • manage or delete your alerts, from any alert email
  • manage your saved jobs
  • delete your profile

Depending on where you live, the law may give you further rights over your personal data, such as asking for a copy of it or objecting to how it is used. We will honour those rights as the applicable law requires.

We update this page when the service changes or the law requires it, and the date at the top changes with it. If a change materially affects how we handle information you have already given us, we will make that clear rather than relying on you noticing a new date.