Data Processing Agreement (DPA)
How we process candidate data on your behalf, under Article 28 GDPR.
Version 1.0. The Romanian text is the binding one; the English translation is provided for information.
Version 1.0 · in force from the date of publication
This agreement forms part of the Partnerd Hire Terms of Use and governs the processing of the personal data that the Client enters into the platform, under Article 28 of Regulation (EU) 2016/679 ("GDPR").
The parties: PARTNERD RECRUITMENT SERVICES S.R.L., Str. Hatman Luca Arbore nr. 34A, Constanța, Romania, J2020003067138, VAT no. RO 43349846 ("Partnerd", the processor) and the organisation that created the workspace ("the Client", the controller).
The agreement is accepted electronically by the workspace administrator, when the workspace is created, on behalf of the Client. Acceptance has the value of a signature; the record of acceptance (person, date, version) is available in the account.
1. The parties' roles
1.1 The Client is the controller. The Client decides why and how its candidates' data is processed: which jobs it publishes, which candidates it enters, how long it keeps the data, whether it enables the artificial intelligence features, WhatsApp or video interviews, who on its team has access.
1.2 Partnerd is the processor. Partnerd processes candidate data only on the Client's behalf and only on its instructions, to provide the platform.
1.3 Where Partnerd is a controller. For the Client's user accounts (name, email, actions in the platform), for billing and for the security of the service, Partnerd is a controller; those processing activities are governed by the Privacy Policy, not by this agreement.
1.4 Recruitment agencies. If the Client is an agency recruiting for its own clients, the Client remains responsible towards Partnerd as controller or, as the case may be, as its clients' processor, and warrants that it has the right to give the instructions in this agreement.
2. Subject matter and duration of the processing
The details of the processing (nature, purpose, categories of data subjects and data, duration) are in Annex A. The agreement applies for as long as the platform is used, including during the trial period, and until the data is deleted under article 10.
3. The Client's instructions
3.1 Documented instructions. Partnerd processes the data only on the Client's documented instructions. The instructions are: this agreement, the Terms of Use, the settings the Client makes in the platform (roles, retention period, enabled modules) and the actions of its users.
3.2 Unlawful instructions. If Partnerd considers that an instruction infringes the GDPR or another law, it informs the Client without delay and may suspend its execution until clarified.
3.3 Legal obligations. If Union or Member State law requires Partnerd to process the data otherwise, Partnerd informs the Client beforehand, unless the law prohibits such information.
4. Partnerd's obligations
Partnerd:
- (a) processes the data only to provide the platform and only on instructions;
- (b) ensures that persons authorised to process the data are bound by confidentiality and appropriately trained;
- (c) implements the technical and organisational measures in Annex B and keeps them at a level appropriate to the risk;
- (d) complies with the conditions on sub-processors in article 6;
- (e) assists the Client, through the platform's features and, where needed, directly, in fulfilling its obligation to respond to data subjects' requests (article 7);
- (f) assists the Client in complying with its obligations on security, breach notification and impact assessment (articles 8 and 9);
- (g) at the end of the services, deletes or returns the data under article 10;
- (h) makes available to the Client the information necessary to demonstrate compliance with Article 28 GDPR and allows audits under article 11;
- (i) does not use candidate data for its own purposes, does not sell it and does not use it to train artificial intelligence models.
5. The Client's obligations
The Client:
- (a) warrants that it has a legal basis for processing its candidates' data and that it has provided them with the information required by Articles 13 and 14 GDPR, including about the use of the artificial intelligence features, WhatsApp and video interviews, when it enables them;
- (b) is responsible for the accuracy of the data and the lawfulness of its instructions;
- (c) sets the retention period for candidate data in the platform and is responsible for it;
- (d) manages its users' access and revokes it when they leave;
- (e) uses the platform in accordance with the Conditions for the artificial intelligence features and fulfils its obligations as deployer of a high-risk artificial intelligence system;
- (f) notifies Partnerd without delay if it becomes aware of a security breach originating from its account or of a request from an authority concerning data in the platform.
6. Sub-processors
6.1 General authorisation. The Client authorises Partnerd to use the sub-processors in the list published at ats.partnerd.ro/legal/subprocesatori (Annex C). At the date of this agreement the list comprises: the database and storage provider (data in the European Union), the hosting provider, the artificial intelligence model provider, the email provider, Meta for WhatsApp, the transcription provider for video interviews, the payment processor, the anti-bot protection provider and the error monitoring provider.
6.2 Changes. Partnerd notifies the Client, by email to the workspace administrator, at least 30 days before adding or replacing a sub-processor that processes candidate data. The Client may object in writing, with reasons, within that period. If the parties cannot find a reasonable solution, the Client may terminate the contract without penalty, with a pro-rata refund of amounts paid in advance for the period after termination.
6.3 Liability. Partnerd enters into an agreement with each sub-processor imposing data protection obligations equivalent to those in this agreement and remains liable to the Client for the sub-processors' performance.
6.4 Services connected by the Client. Job boards (eJobs, BestJobs, OLX), Zoom, Microsoft Teams and other services the Client connects on its own accounts are not Partnerd's sub-processors; they process the data under their own terms and under the Client's responsibility.
7. Data subjects' rights
7.1 Requests received by Partnerd. If a candidate contacts Partnerd directly with a request about data processed for the Client, Partnerd directs them to the Client and informs the Client within 5 working days, without answering on the merits, unless the Client has instructed otherwise.
7.2 Tools in the platform. The platform gives the Client tools to answer requests: export of a candidate's data, rectification, erasure (executed automatically within 48 hours), explanation of evaluations assisted by artificial intelligence and tracking of the 30-day legal deadline.
7.3 Further assistance. On request, Partnerd provides reasonable further assistance. For requests that go beyond the platform's features and require significant effort, Partnerd may bill the time at its hourly rate, communicated in advance.
8. Security and security breaches
8.1 Measures. Partnerd applies the measures in Annex B. Their detailed description is available to the Client on request.
8.2 Breach notification. Partnerd notifies the Client, by email to the workspace administrator, without undue delay and within 24 hours at most of becoming aware of a security breach affecting the Client's data. The notification includes, to the extent known: the nature of the breach, the categories and approximate number of persons and records affected, the likely consequences, the measures taken or proposed and a point of contact. Information not available initially is provided as it becomes available.
8.3 Cooperation. Partnerd cooperates with the Client in investigating the breach, in limiting its effects and, where applicable, in notifying the supervisory authority and informing the affected persons, which remain the Client's responsibility as controller.
9. Impact assessment and prior consultation
Partnerd assists the Client, with the information it holds about the platform, in carrying out data protection impact assessments (Article 35 GDPR) and in prior consultation of the authority (Article 36). Partnerd's compliance documentation (record of processing, the platform's impact assessment, documentation of the artificial intelligence features) is made available to the Client on request, under confidentiality.
10. Deletion and return of data
10.1 During the contract. The Client can export and delete data from the platform at any time. Erasures requested by candidates are executed automatically within 48 hours. Data whose retention period has expired is deleted automatically, after the candidate has been informed according to the Client's settings.
10.2 At the end. After the contract ends, for whatever reason, the Client has 30 days to export its data, during which the workspace is in "read-only" mode. After that period Partnerd permanently deletes all of the Client's data, including from backups, within a further 30 days at most, except what the law requires to be kept. On request, Partnerd confirms the deletion in writing.
10.3 The decision log. Records in the log of the artificial intelligence features are anonymised when the candidate's data is deleted, so that they can no longer be linked to a person. They are kept in anonymised form for Partnerd's traceability obligations under Regulation (EU) 2024/1689.
11. Audits
11.1 Documentation. Partnerd makes available to the Client, on request, the information necessary to demonstrate compliance with this agreement: the description of the security measures, the list of sub-processors, reports or certifications obtained.
11.2 On-site or remote audit. If the documentation is not reasonably sufficient, the Client may carry out an audit, directly or through an independent auditor bound by confidentiality, at most once a year (or after a breach that affected it), with 30 days' notice, during working hours, without disrupting Partnerd's activity and without access to other clients' data. The costs of the audit are borne by the Client, unless the audit reveals a significant breach of the agreement by Partnerd.
12. International transfers
The data is stored in the European Union. Where a sub-processor processes data outside the Union or the European Economic Area, the transfer is covered by an adequacy decision of the European Commission (including the EU-US Data Privacy Framework, for certified providers) or by the Commission's standard contractual clauses, with the necessary supplementary measures. Details for each sub-processor are in Annex C. The Client authorises these transfers and does not instruct Partnerd to transfer data to other countries.
13. Liability
Each party's liability under this agreement is subject to the limitations in the Terms of Use, except for liability towards data subjects and fines imposed by authorities, which are allocated between the parties under Articles 82 and 83 GDPR according to each party's responsibility.
14. Final provisions
14.1 Precedence. On matters of personal data, this agreement prevails over the Terms of Use. A data processing agreement signed separately by the parties prevails over this one.
14.2 Changes. Partnerd may update the agreement to reflect changes in the law or in the platform, with 30 days' notice and re-acceptance by the workspace administrator, following the procedure in the Terms of Use. Changes do not lower the level of data protection.
14.3 Contact. For any data protection matter: privacy@partnerd.ro. Partnerd has not appointed a data protection officer (DPO).
14.4 Law. The agreement is governed by Romanian law and the GDPR.
Annex A — Details of the processing
| Element | Content |
|---|---|
| Subject matter | Provision of the Partnerd Hire recruitment platform, including the modules enabled by the Client (artificial intelligence, WhatsApp, Introvid video interviews, job board integrations) |
| Nature of the processing | Collection (through application forms, import, manual entry), storage, structuring, organisation, consultation, analysis assisted by artificial intelligence, communication (email, WhatsApp), export, deletion |
| Purpose | Management of the Client's recruitment processes: publishing jobs, receiving and evaluating applications, communicating with candidates, scheduling interviews, archiving candidates for future jobs (with their consent), answering candidates' requests |
| Data subjects | Candidates and applicants for the Client's jobs; persons in the Client's candidate archives; the Client's contact persons mentioned in communications |
| Categories of data | Identification and contact data (name, email, phone, address, LinkedIn profile); CV and application data (experience, education, skills, languages, certifications, licences, attestations); answers from the application form; uploaded documents (CV, portfolio); messages exchanged with the Client (email, WhatsApp); interview schedules and notes; if video interviews are enabled: the video recording, its transcript and evaluation; the results of the artificial intelligence features (CV structuring, indicative score, explanations) and the subsequent human decision; the log of actions on the candidate's record |
| Sensitive data | The platform does not request special-category data (Article 9 GDPR). If a candidate includes it in a CV, the platform detects it, masks it on display and excludes it from automated evaluation. The Client undertakes not to request such data through the application form questions |
| Duration | For the duration of the recruitment process, then for the retention period set by the Client (by default 12 months from entry into the platform), with the candidate informed 30 days before expiry and automatic deletion; at the latest on the deletion provided for in article 10 |
| Frequency | Continuous, for the term of the contract |
Annex B — Technical and organisational measures
| Area | Measures |
|---|---|
| Data location | Database, files and backups are hosted in the European Union (Ireland) |
| Client separation | Each Client has a separate workspace; isolation is enforced at database level, on every table, so that a user cannot access another workspace's data whatever the access path |
| Access control | Sign-in with email and password or a secure link; differentiated roles and rights (administrator, recruiter, hiring manager, agency) with access limited to assigned jobs and candidates; immediate revocation of access by the administrator |
| Encryption | Data encrypted in transit (TLS) and at rest (at storage infrastructure level) |
| Traceability | Log of actions performed in the platform (who, when, from where, what); separate log of every use of the artificial intelligence features (input, output, model version, subsequent human decision) |
| Minimisation and masking | The evaluation features do not receive irrelevant or risky fields (age, graduation year, address, native language, salary); sensitive data detected in CVs is masked on display and excluded from evaluation |
| Automatic retention | Retention period per workspace, with the candidate notified before expiry and automatic deletion; erasure on request executed automatically within 48 hours |
| Protection of public forms | Anti-bot verification and rate limiting on application and account creation forms |
| Providers | Each sub-processor is bound by a data processing agreement; the artificial intelligence model provider does not train models on the data transmitted |
| Staff | Partnerd staff access to client data is limited to support and operations, on a need-to-know basis, under a confidentiality obligation |
| Continuity | Automatic daily backups of the database, kept in the European Union; infrastructure provided by operators with recognised certifications (ISO 27001, SOC 2) |
| Incidents | Internal incident response procedure, with investigation deadlines, notification of affected clients within 24 hours and notification of the authority within 72 hours where required |
| Development | Code review before release, periodic security testing, updating of components with known vulnerabilities |
Annex C — Sub-processors
The current list, with the purpose, categories of data, processing location and transfer safeguard for each sub-processor, is published and kept up to date at ats.partnerd.ro/legal/subprocesatori and forms part of this agreement. Changes are announced under article 6.