Data Processing Agreement (DPA)
This agreement applies when a customer (the “Controller”) uses CVShortlist to analyse CVs containing candidates' personal data. NEXTCALL ROMANIA S.R.L. (the “Processor”) processes such data on the Controller's behalf under Art. 28 GDPR.
1. Parties
- Controller: the customer who uploads CVs and determines the purpose and means of processing (the recruiting employer).
- Processor: NEXTCALL ROMANIA S.R.L., VAT RO49309158, reg. J27/1262/2023, Str. Traian nr. 27, bl. A8, sc. A, et. 4, ap. 13, cod postal 610137, Piatra Neamt, jud. Neamt, Romania.
2. Subject-matter, duration, nature and purpose
Processing consists of automated analysis and scoring of CVs to support the Controller's recruitment decisions, for the duration of service use.
3. Categories of data and data subjects
Data subjects: candidates whose CVs are uploaded. Data categories: identification and contact details, professional experience, skills, and any other information the candidate includes in the CV.
4. Processor obligations
- Processes data only on the Controller's documented instructions.
- Ensures confidentiality of persons authorised to process the data.
- Implements appropriate security measures (Art. 32 GDPR).
- Assists the Controller with data-subject requests and with security and breach-notification obligations.
- Deletes or returns data at the end of the service and deletes existing copies, subject to legal retention.
- Makes available information needed to demonstrate compliance and allows reasonable audits.
5. Sub-processors
| Sub-processor | Service | Location |
|---|---|---|
| Anthropic PBC | Automated text analysis (Claude API) | USA |
| Hetzner | Application and database hosting | Germany / EU |
| ROMARG | Web hosting | Romania / EU |
We will inform the Controller of any change of sub-processors, with the opportunity to object.
6. International transfers
Transfers to sub-processors outside the EU/EEA (e.g. Anthropic, USA) rely on the Standard Contractual Clauses and appropriate supplementary measures.
7. Security incidents
The Processor notifies the Controller without undue delay after becoming aware of a breach affecting data processed on the Controller's behalf.
8. Termination
On termination, candidate data and related files are deleted per the Controller's instructions and retention policies.