Cookie policy

Cookies are small text files a website stores in your browser. Local storage (localStorage) works similarly: the data stays on your own device. This policy covers both for talentlist.nl.

TalentList only sets its own (first-party) cookies needed for login and security:

__Secure-next-auth.session-token: keeps you signed in. Encrypted and not readable by scripts. Expires at most 7 days after your last activity or when you sign out.

__Host-next-auth.csrf-token: protects the sign-in form against misuse by other websites (CSRF). Expires when you close your browser.

__Secure-next-auth.callback-url: remembers which page to return to after signing in. Expires when you close your browser.

__Secure-tl-sso-handoff: only used when signing in through your organisation’s single sign-on (SSO). Expires after 60 seconds.

TalentList keeps some data on your own device only. It is not sent to us automatically:

flexpool-wizard-draft:v2 (business accounts): a local draft of a new flexpool, scoped to your user and business. You can resume it for up to seven days. Creating the pool, discarding the draft or explicitly signing out removes it. Cancelling keeps the draft. Legacy drafts without an owner are not imported. Local storage depends on your browser allowing it.

smart-setup-draft:v1 (business accounts): edited Smart Setup proposals, scoped to your user, business and language. Resumable for up to seven days on this device. Successful confirmation or signing out removes the draft.

jobFormTemplates:v2 (business accounts): your form templates, scoped to your user and business. Kept until you delete them or clear your browser data. Old templates without an owner are not loaded.

nextauth.message (all accounts): a short signal that keeps signing in and out in sync across your open tabs. It only holds the type of signal and a timestamp, no login details. Kept until you clear your browser data.

The cookies and storage above are strictly necessary for the service you use. Dutch law does not require consent for them, so we show no cookie banner. If we ever want to use optional cookies, for example for statistics, we will ask for your consent first and update this policy.

We use no advertising, tracking or analytics cookies and no social media pixels. Technical error reports are collected without cookies to fix problems. Session recordings are switched off.

On pages with a map, your browser loads map images directly from OpenStreetMap, which receives your IP address and browser details. TalentList sets no cookies for this; see the OpenStreetMap Foundation privacy policy for their processing.

Businesses can place a TalentList application form on their own website. That form sets no tracking cookies. Cookies of the website itself are covered by that business’s policy.

You can view and delete cookies and local storage in your browser settings. If you block essential cookies, you cannot sign in. Signing out removes your sign-in session.

When this policy changes, we update the date at the top. The privacy notice explains how personal data is processed. Questions? Email info@talentlist.nl.