+40 373 805 700

GENERAL DATA PROCESSING AGREEMENT (DPA)

Integral annex to the BestJobs General Terms and Conditions and Privacy Policy

Applicable to all users (legal entities and natural persons) who post job advertisements and/or recruit on the Platform

This Data Processing Agreement (the “DPA”) supplements and is to be construed together with the General Terms and Conditions and the Privacy Policy of the BestJobs platform.

This DPA applies automatically to any user – legal entity or natural person (PFA, PFI, independent recruiters, employers who are natural persons) – hereinafter referred to as the “Employer” or the “Recruiter”, who uses the services of BESTJOBS RECRUTARE S.A. (“BestJobs”) for posting advertisements, accessing CVs, screening/AI services, or the use of technical integrations and automated data export to third-party systems (API/ATS).

1. Interaction with the Platform Documents and Delimitation of GDPR Roles

  • 1.1. Integration into the framework: This DPA forms an integral part of the BestJobs contractual agreement. In the event of any inconsistency between the provisions of the General Terms and Conditions, the Privacy Policy and this DPA in the area of automated export to third parties, the provisions of this DPA shall prevail.

  • 1.2. Independent Controllers (Direct applications): In accordance with Section 3 (Purposes and legal bases) and Section 7 (To whom we transmit the data) of the Privacy Policy, where candidates apply directly to jobs, BestJobs and the Employer/Recruiter act as Independent Controllers.

  • 1.3. BestJobs as Processor (Screening): Pursuant to Section 1 of the Privacy Policy, for the services provided to the Employer/Recruiter that involve the direct import of external CVs onto the platform for screening purposes, BestJobs acts as a Processor, processing the data strictly in accordance with the Employer’s/Recruiter’s instructions.
2. Automated Data Export and Integrations with Third-Party ATS Systems

  • 2.1. Derogation from the prohibition on scraping: By way of exception to Section 3 (Rules of conduct) of the General Terms and Conditions, which prohibits the unauthorised collection of data (scraping), the Employer/Recruiter is permitted to export candidate data automatically solely through the official technical integrations (API / Webhooks) offered or approved by BestJobs, to its own recruitment management system (ATS – Applicant Tracking System).

  • 2.2. Application of the Security Mechanisms: Automated export complies with the platform’s security measures set out in Section 6 of the Privacy Policy (Dynamic Masking of Contact Details), the data being transmitted only following authorised unlocking on the basis of credits/licences.Contact), datele fiind transmise doar după deblocarea autorizată pe bază de credite/licențe.

  • 2.3. Transfer of Liability upon Export: From the moment personal data is exported or transmitted automatically from BestJobs to the third-party ATS:

  • The Employer/Recruiter (natural or legal person) becomes the Exclusive and Independent Controller for the copy of the data stored in its own ATS.

  • The provider of the ATS solution acts as a Processor of the Employer/Recruiter (Sub-processor within the meaning of Article 28 GDPR) and not as a processor of BestJobs.

3. Obligations of the Employer / Recruiter (Natural or Legal Person)

In accordance with the GDPR and in conjunction with the BestJobs Privacy Policy, the Employer/Recruiter undertakes:

  • 3.1. DPA with the ATS provider: To ensure that it has concluded a data processing agreement (DPA) in accordance with Article 28 GDPR with the third-party ATS provider, guaranteeing adequate technical security measures.
  • 3.2. Transparency and Retention: To provide candidates with its own Privacy Notice regarding the processing carried out in its own ATS. The Employer/Recruiter shall take into account that on the BestJobs platform, in accordance with Section 8 (Data retention period) of the Privacy Policy, unlocked CVs and applications are removed from the employer account after a maximum of 1 year, and shall be under an obligation to manage the storage periods in its own ATS lawfully.
  • 3.3. Candidates’ Rights: To handle directly the requests of data subjects concerning their GDPR rights (access, erasure, rectification, objection – detailed in Section 10 of the Privacy Policy) in respect of the data that has reached its own ATS.
4. Security, Liability and Exoneration
  • 4.1. Security of the Account and of the Integration: The Employer/Recruiter bears full responsibility for the security of the authentication credentials and of the API keys, in accordance with Section 2 (Account Creation and Security) of the General Terms and Conditions.
  • 4.2. Limitation of BestJobs’ Liability: In conjunction with Section 7 (Limitation of Liability) of the General Terms and Conditions, BestJobs is not liable for any security breach, data loss, unauthorised storage or unlawful processing occurring within the third-party ATS system or along the transit route managed by third-party systems.
  • 4.3. Indemnification: The Employer/Recruiter (natural or legal person) shall indemnify BestJobs in full for any damages, administrative fines (imposed by ANSPDCP or another authority) or candidate complaints arising from the improper use of the API integrations or from a breach of the GDPR within the ATS system used.
5. Entry into Force and Amendments

This DPA is valid from the date the account is created or the API/ATS integration is activated. In accordance with the provisions of the preamble to the General Terms and Conditions, BestJobs reserves the right to amend this document periodically in order to reflect legislative or technical changes, the updated version being applicable from the moment it is published on the platform.