Data processing / Privacy policy

Last updated on 02.04.2024

IMPORTANT: When presented with this Policy, at the time of creating an account on the website www.undelucram.ro ("the Site"), we consider that you understand how your personal data ("PD") is used on the Site. Furthermore, in the event that your consent is requested regarding this Policy and the processing of PD in accordance with this Policy, such consent signifies your agreement to the processing of PD for which such consent is required, in accordance with the provisions of this Policy.

This Policy is intended to provide you with the clearest and most transparent explanation of how your PD is processed. Therefore, the document is in a continuous process of change - we recommend that you regularly visit this document to stay informed about the most current version.

If you have any questions about PD or this Policy, or suggestions for improving our product and the way information about PD is presented, please email us at datepersonale@undelucram.ro and we will respond promptly!

IN BRIEF

We want to offer you (the "User") the opportunity, through the Site, to find relevant information about the labor market, to appreciate and evaluate your experience in relation to various employers available on the platform ("Employers"), and to apply for job openings offered by these Employers using your CV. In order to achieve these objectives, we need to access various types of PD.

This Policy contains provisions applicable to both individual Users interested in contributing information and/or applying for job openings available on the Site, as well as Users representing an Employer on the Site.

Therefore, please read this Policy to understand the relationship between your PD and the Site, specifically: who processes and who has access to this PD, for what purpose and on what basis the processing is carried out, what are your rights regarding your PD, and other relevant details.

What PD are we referring to? The Site processes the information obtained from you both directly (for example, when you complete a form or a text box on the Site, such as the registration form or the Feedback section form, or the forms where you express your opinion about your relationship with an Employer) and indirectly (for example, as a result of using the Site from a specific device identified by a specific IP address).

Some of this information is PD (i.e., information that can identify you or lead to your identification). Among these:

• One category is necessary to make the Site function (for example, the email address is necessary to validate your account on the Site and thus enhance the security of your account);

• Another category is used based on our legitimate interests (we, the "Company", defined below) - for example, the name, username/nickname are used to limit situations where a User could post an anonymous contribution, the veracity of which would be questionable by other Users of the Site;

• Lastly, a final category of PD is processed with your explicit and prior consent, the existence of which we store in relation to the moment when we obtain it from you. You can find more details about the PD processed in Section 3 below.

Who can process the PD belonging to you, through the site? Firstly, the entity operating the Site, called the "Company": Undelucram SRL, a company registered and operating in Romania. You can find more about us and our identification data by accessing the Terms and Conditions of the Site accessible here, or by emailing us at datepersonale@undelucram.ro.

Secondly, in the development and operation of the Site, we use products and services developed and operated by third parties. These have the technical capacity to store/access/process some of the PD collected by us through the Site and process them according to the purposes indicated by us. All these third parties and their role in the Site architecture and PD processing are described in Section 4.1 below.

Thirdly, a significant part of the PD belonging to me is accessible to Employers who are active on the Site only if you have applied (of your own initiative) based on the CV uploaded or created by you on the Site for job positions posted by Employers. You can find more details about how Employers use PD belonging to you in Section 4.2 below. However, Employers do not have and will not have the possibility to access PD to see the authors of the information - reviews, salaries, interview information, and benefits - left by Users on the platform.

All PD belonging to me is processed by third parties that either are located and process PD within the territory of the European Union, or process this PD in accordance with the provisions of European Union law. Thus, we want to collaborate only with entities that process PD through systems located in the territory of the European Union or that comply with the provisions of European Union law and to use PD storage services that allow us to store them in the territory of the European Union or in accordance with European Union regulations.

You have a series of rights regarding PD, which we are open to help you exercise. You can find out more about these rights in Section 5 of this Policy.

If you have any questions or concerns regarding the content of this Policy, or suggestions for its improvement, you can contact us at datepersonale@undelucram.ro.

This Policy is supplemented by the terms and conditions of use of the Site, available for consultation here.

Details about the operator

• UNDĂLUCRAM S.R.L., a Romanian legal entity, with its registered office in Cluj-Napoca, Str. Regele Ferdinand nr. 22-26, Centrul Comercial Central, floor 3 (correspondence address: B-dul Iuliu Maniu 6L, Campus 6.1, floor 3, Sector 6, Bucharest), registered with the Trade Registry under no. J12/2388/2019, fiscal code 37266398 (hereinafter referred to as the "Company"), holder of all rights over the Site (as defined below), respects the private nature and security of the processing of personal data of each user of the Site, being the operator of personal data, in accordance with the provisions of Law no. 677/2001 on the protection of individuals with regard to the processing of personal data and the free movement of such data and of the General Data Protection Regulation no. 2016/679 ("GDPR").

Definitions

In this document, the words used with initial capital letters shall have the following meanings:

a) "Site" means the website associated with the domain name undelucram.ro, whose rights are exclusively owned by the Company, through which Users (as defined below) can find relevant information about the labor market, appreciate and evaluate the experience with various employers available on the platform ("Employers", defined below) and apply for job positions open by these Employers using a Curriculum Vitae (CV);

b) "Employer" means any legal entity whose profile is available on the Site, regardless of whether this profile is active and managed by a User representative of the Employer, or inactive;

c) "User" means any individual over the age of 16 who is in one of the following situations: (1) accesses the Site without creating an account within it; (2) has an account created within the Site, used to be able to make contributions specific to a User who does not represent an Employer (comments and evaluations of interactions with an Employer; CV uploads; job applications available on the Site); (3) has an account created within the Site, used to be able to make contributions specific to a User who represents an Employer (adding job positions available within the Employer; responding to comments and evaluations submitted by other Users); to avoid any doubt, the Site is not intended for use by individuals who do not meet the conditions described in this definition and, explicitly, is not intended for use by minors (within the meaning of the legislation applicable to a particular user);

d) "Third Party Site" means a site, other than the Site, whose content is available on the Site, the character of Third Party Site being distinctively highlighted alongside the content it owns, in the section of the Site where this content appears;

e) "Personal Data" or "PD" means any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more specific factors of his physical, physiological, mental, economic, cultural or social identity;

f) "Services" means the package of services made available by the Company to Employers who opt for one of the two service packages available for Employers within the Site, as described here: https://www.undelucram.ro/cont-companie/comparati-serviciile;

Personal Data processed and purposes of processing

For and in connection with the operation of the Site, Personal Data is processed on the basis of several legal grounds and for several purposes:

3.1 Based on the legitimate interest of the Company, we process the following Personal Data:

3.1.1 the IP address of the device used to access the Site (strictly to be able to establish a connection between unusual activities on the Site - for example, a large number of comments submitted by a User at the same time, which lead to the impairment of the Site's functioning - and a certain User, so that we can assess the extent to which those activities are manual or automated, created by software attempting to affect the functioning of the Site, and to take the technical measures required by the situation);

3.1.2 the position held by a User representing an Employer within that Employer (to be able to increase the level of trust of other Users regarding the fact that the positions expressed by the Employer on the Site are positions assumed by that Employer);

3.1.3 the age and city from which a User accesses the Site, to aggregate this data and present it to Employers, based on the Services provided by the Company; this data is not presented individually for each User, the Employer not having the possibility, within the Site, to find out, individually, from which city a certain User comes or what age a certain User has, unless the User makes this information public;

3.1.4 the locality, the position held by a User within an Employer, and the period in which this User worked within the Employer, necessary to be able to outline as accurately as possible the experience had by the User. To protect the User's identity, the only data required compulsorily among those mentioned is the locality.

3.2 Based on the need to provide a service to Users who have engaged in using the Site, namely to make and keep the Site functional and to provide the Services, we process the following Personal Data:

3.2.1 Email address and/or phone number (to validate the creation of an account and also to send notifications and other information to a User about their activity on the Site - for example, information about the activity of Employers followed by a User on the Site);

3.2.2 Name, username/nickname (to provide authenticity to the comments and contributions added by a User within the Site, which is essential for reflecting as complete and accurate information as possible on the Site about the labor market). Considering the profile of the Site, the expectations of Users are to find updated and real information about their interaction with the Employers whose profiles are present on the Site.

3.2.3 Data related to an invoice issued to Employers for the Services provided by the Company, to the extent that they contain PD included by Users representing Employers (to allow the issuance of invoices related to the Services provided by the Company); this data is processed by the Company only for the duration necessary for the collection of payment for the Services and the reflection of this payment in accounting;

3.3 In the case of fast registration on the site through the social networks Facebook, Google, and LinkedIn, we collect the following data: name and email address.

3.4 The Site also uses cookies in its operation, about which you can learn more by accessing the cookie policy accessible here.

3.5 To avoid any doubt, the Company does not access and does not use in any way PD contained in the CVs uploaded on the Site.

Who processes PD

4.1 Authorized representatives of the Company

Personal Data processed through the Site are made available to the following third-party entities, whose products/services are necessary for the development and operation of the Application:

4.1.1 Google LLC, for the Google Analytics product, used to analyze the city from which and the device from which a User accesses the Site;

The privacy policy regarding the processing of personal data by Google Analytics is accessible here.

4.1.2 HotJar Ltd, for the HotJar product, used to analyze the sections of the Site where a User spends the most time;

The privacy policy regarding the processing of personal data by HotJar is accessible here.

4.1.3 Claus Web SRL, for hosting the Site;

The privacy policy regarding the processing of personal data by Claus Web SRL is accessible here.

4.1.4 Cloudflare, for the security service of the Site;

The privacy policy regarding the processing of personal data by Cloudflare is accessible here.

In choosing these entities, the Company takes into account their compliance with the applicable provisions regarding the processing of Personal Data. If the Company decides to add new entities and products or to replace these entities and products, you will be notified in advance, having the possibility to refuse the further use of the Site if you consider that the processing of Personal Data by a certain entity is to your disadvantage.

4.2 About Employers

4.2.1 To be able to provide Services to Employers, the Company allows them to activate their profiles on the Site and to carry out several activities, as described in the types of service packages available here: https://www.undelucram.ro/cont-companie/comparati-serviciile

4.2.2 In the event that a User applies to one of the job positions belonging to an Employer, using a CV, the Employer has the possibility to evaluate all the Personal Data within that CV. Additionally, an Employer can download such a CV, outside the control of the Company. We are currently assessing the possibility of technically limiting Employers' access to User CVs outside the Site.

4.2.3 To the extent that a User wishes to find out more details about the Personal Data that an Employer holds about the User, they can contact the Employer using the contact details indicated in the Employer's profile on the Site.

4.3 Term of processing of Personal Data

4.3.1 Personal Data provided by Users will be processed by the Company in electronic format for the entire period during which the individual providing the Personal Data has the status of a User, as well as for a period of three years after the termination of this status, by deactivating the account within the Site.

4.3.2 Personal Data is kept after the period in which an individual is a User of the Site, in order to study to what extent certain activities of the Company attract the reactivation of the account by former Users.

• 4.3.3 In any case, after deleting the User's account within the Site and after the expiration of the term indicated above in point 4.3.1, the Personal Data of that User will only be used for statistical and analysis purposes, to present, in different public contexts, relevant information about the number of historical users of the Site and their activities on the Site.

User Rights

Users have the following rights regarding the Personal Data that belongs to them, which they can exercise by sending an email to datepersonale@undelucram.ro:

5.1 Right of access to Personal Data

5.1.1 Any User can request from the Company, free of charge, for a request once every 6 months, confirmation of whether there is Personal Data related to the User processed or not by the Company. If affirmative, the Company must inform the User about: the purposes of the processing; what categories of Personal Data are processed and, to the extent that these Personal Data are not current/updated/relevant, the right to request the rectification, deletion, or restriction of the processing of these Personal Data, or to object to the processing of Personal Data; which individuals/legal entities have access to the Personal Data; the storage period of the Personal Data; the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing, to the extent that the User considers that they cannot exercise their rights in relation to the Controller.

5.1.2 The Company may charge a fee for providing this information, to the extent that requests from a User are more frequent than once every 6 months, the fee will be communicated to the User at the time the User makes a new request within the mentioned period, having the same purpose.

5.2 Right to rectify Personal Data

Any User can request from the Company, free of charge, the rectification of inaccurate Personal Data concerning them. If deemed necessary, subsequent to the Company's response, the User may request the completion of Personal Data, and the Company may either make the necessary changes within the User's account on the Site or indicate to the User the steps by which they can make this rectification.

5.3 Right to erase Personal Data

5.3.1 The User can request from the Company the deletion of Personal Data concerning them, and the Company will comply with this request in the following situations:

5.3.1.1 if the Personal Data for which deletion is requested are no longer necessary for the Company for the purposes in which they were collected or processed (for example, the User requests the deletion of an uploaded CV on the site).

In this regard, the Company will send a response to the User, explaining the necessity of processing the Personal Data in question in relation to the purposes of processing, as well as the consequences of deletion. To the extent that the User considers that this processing no longer aligns with the purposes indicated by the Company, they can maintain their position regarding the deletion of Personal Data, assuming responsibility for any effects related to the use of the Site resulting from the deletion of those Personal Data;

5.3.1.2 if the User withdraws their consent for the processing of Personal Data, if the Personal Data in question are processed based on the User's consent as the legal basis (you can find more details about the legal bases for processing Personal Data in Section 3 above);

5.3.1.3 if the User objects to the processing of Personal Data, according to the provisions of this Policy; the Company will send a response to the User, indicating to what extent there are legitimate reasons for further processing the Personal Data. In the event that the Company sends a newsletter to Users or other methods of commercial communication, the User will have the opportunity at any time and for any reason to opt-out of receiving these communications;

5.3.1.4 if the User believes that the processing of Personal Data has been carried out unlawfully; the Company will send a response to the User, explaining to what extent there is a legal basis for the processing of Personal Data; to the extent that the User considers that this processing no longer aligns with the purposes indicated by the Company, they can maintain their position regarding the deletion of Personal Data, assuming responsibility for any effects related to the use of the Site resulting from the deletion of those Personal Data;

5.3.2 The Company may refuse to comply with the User's request if the Personal Data whose deletion is requested cannot be deleted due to a legal obligation of the Company's activity (in which case the Company will indicate to the User the legal basis of this obligation), or for archiving or statistical reasons (in which case the Company will indicate to the User the measures it can take to ensure that the User's Personal Data are processed in a safe manner and that the processing occurs only to provide aggregated information about the Users' behavior regarding the Site).

5.4 Right to restriction of processing Personal Data

The User has the right to request the Company to restrict the processing of Personal Data, in one of the following cases:

5.4.1 The User indicates that the Personal Data concerning them are not correct, and the Company cannot rectify the Personal Data immediately upon receiving communication to this effect from the User;

5.4.2 The User indicates that the processing is not lawful, but does not wish to delete the data, only wanting to restrict the processing;

5.4.3 The User indicates that they want the Personal Data to be accessible on the Site to be able to use them in defense/exercise/establishment of a right before an authority, but does not want the Personal Data to be processed for other purposes;

5.4.4 The User contests the legitimate interest of processing Personal Data (which are processed on this legitimate interest) by the Company, and the Company cannot, at the time of receiving the User's request, evaluate to what extent the Company's legitimate interest outweighs the right exercised by the User.

If the right to restrict processing is exercised, the Company will inform the User in advance, as appropriate, before the restriction of processing no longer applies, and the Personal Data will be processed again.

5.5 Right to data portability

The User may request the Company to transmit all Personal Data provided by the User to the Company (so only the Personal Data directly entered by the User on the Site or referring to their preferences within the Application), in a format that allows the User to transmit this Personal Data to another entity (for example, to request the download of the CV already created on the Site or the profiles of Employers followed on the Site), to be able to access new services or products. This right is exercisable only in the case of Personal Data processed based on the User's consent or for the performance of the contract with the User.

5.6 Right to object

5.6.1 The User has the right to object to the processing of Personal Data processed based on the legitimate interest of the Company, according to the provisions of this Policy. In this regard, the User can send an email to the Company at datepersonale@undelucram.ro, mentioning the reason for objecting to the processing of Personal Data concerning them (in whole or in part).

5.6.2 The Company will respond to the User within 30 days of receiving the request, indicating to what extent it considers that the Company's legitimate interest prevails over the reason for objection indicated by the User.

5.6.3 In case the User does not want to receive marketing and/or promotional messages from the Company (to the extent that the Company sends such messages to the User), they may express their option at any time.

5.6.4 If the exercise of the right by the User is legitimate, the Company will take the necessary steps to stop processing the Personal Data of that User;

5.7 The User has the possibility to address the National Supervisory Authority for Personal Data Processing to the extent they feel aggrieved by the response received from the Company/lack of response to their request to exercise one of the rights mentioned in this Policy.

5.8 Correspondence

5.8.1 To exercise the rights mentioned above, the User can contact the Company at datepersonale@undelucram.ro.

5.8.2 The Company will analyze each request individually and will communicate with the User in order to fulfill their requests in a manner as close as possible to the User's expectations.

5.8.3 The Company will respond to User requests within 30 calendar days from the date of receiving the request. If an extension of this period is necessary, the Company will inform the requesting User about this need before the expiration of the initial term.

Confidentiality of Personal Data

6.1 The Company uses only the Personal Data it needs and only for the purposes described in this Policy. To the extent that we no longer need to process certain Personal Data, we will cease processing them and inform you about these changes regarding the processing of Personal Data.

6.2 In processing Personal Data, the Company provides access only to employees/collaborators of the Company who need access to certain Personal Data to carry out their activities based on their relationship with the Company.

6.3 Apart from the entities mentioned in this Policy, we will not grant access to Personal Data to other third-party entities without informing you in advance about this aspect.

Security of processing

7.1 The Company has the obligation to manage the Personal Data provided by Users through the Site securely.

7.2 Personal Data are protected as follows:

7.2.1 Regarding the possibility of viewing and accessing Personal Data, they are stored on the servers of the hosting service provider, accessible only by a senior management person of the Company;

7.2.2 Regarding the retention of Personal Data, in addition to storing them on the servers of the hosting service provider, there is a copy of them, also stored on the same servers, accessible by password by a single person from the senior management of the Company;

7.3 The security of a User's account also depends on maintaining the confidentiality of login data by the User on the platform. In this regard, the Company recommends to Users:

7.3.1 Using a strong password and regularly updating it;

7.3.2 Avoiding the use of the same password for multiple applications;

7.3.3 Implementing automated antivirus and security systems for the information systems used to access the Site (e.g., antivirus software installed on the device used to access the Site);

7.3.4 Avoiding storing the password for the User's account in unprotected or accessible documents;

7.3.5 Avoiding disclosing details of the password for the User's account to other persons.

7.4 The Company will not be held responsible for the negligence or inaction of the User leading to the compromise of the security of the account within the Site