Privacy Policy

Net-Connect Devworks SRL  |  Effective Date: 1 June 2026

1. Introduction and Identity of the Data Controller

This Privacy Policy describes how Net-Connect Devworks SRL (“Our Company”), with registered address at Central Business Park, 133 Calea Șerban Vodă, Building A, ground floor, sector 4, Bucharest, Romania, registered under nr. J2026022143006 and RO54410891, acting as the data controller, collects, uses, and protects your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable national legislation.

Contact details of the data controller:

Email: [email protected]

Phone: +40 318 108 890

Net-Connect Devworks SRL is committed to protecting the personal data of data subjects and complying with its obligations under the applicable law on the protection of personal data.

The purpose of this information note is to provide you with information on the categories of personal data that Net-Connect Devworks SRL collects throughout your interaction with the Headcount platform, the purposes that it uses such data for in the course of its activity, the period that this data is retained for, the entities the personal data are transferred to, the rights you have in relation to your data, and how you can exercise them, as well as other relevant aspects set out hereinafter.

Privacy policies of other websites

The Net-Connect Devworks SRL website contains links to other websites. Our privacy policy applies only to our website, so if you click on a link to another website, you should read their privacy policy.

2. What Personal Data We Collect

2.1 Data You Provide Directly

  • Full name
  • Email address
  • Phone number
  • Postal address
  • Billing and payment details
  • Personal data of third parties
  • Any document(s) you upload for processing

2.2 Data Collected Automatically

  • IP address
  • Browsing data (cookies, pages visited, time spent, navigation behaviour)
  • Device type and browser
  • Approximate location (derived from IP)

2.3 Data from Third-Party Sources

  • Social networks (if you sign in via a social account)
  • Business partners or analytics providers

3. How Do We Collect Your Data

You directly provide Our Company with most of the data we collect. We collect and process data when you:

  • Register online or place an order for any of our products or services.
  • Voluntarily complete a customer survey or provide feedback on any of our message boards or via email.
  • Use or view our website via your browser's cookies.
  • Voluntarily upload documents.
  • Use our services to generate new data.

4. Purposes and Legal Bases for Processing

4.1 Purpose of Processing — How do we use your data?

Our Company collects your data so that we can:

  • Process your order, manage your account.
  • Email you with special offers on other products and services we think you might like.
  • Deliver our software services.
  • Provide and operate the services (including candidate registration, profile management and account administration).
  • Evaluate applications, scoring CVs and conducting preliminary interviews using automated tools (AI).
  • Provide candidate data and evaluation results to client employers/recruiters who use our services.
  • Undertake statistical analysis and internal research, product improvement and model training (performed only on anonymised data).
  • Conduct security, fraud prevention and misuse detection.
  • Use it for other legal purposes (handle and resolve legal claims and disputes, address possible regulatory investigations, enforce our Terms of Service, comply with lawful requests from law enforcement, comply with laws and regulations that apply to Headcount.work).

Marketing

Our Company would like to send you information about products and services of ours that we think you might like. If you have agreed to receive marketing, you may always opt out at a later date.

You have the right at any time to stop Our Company from contacting you for marketing purposes or giving your data to other members of the Our Company Group. If you no longer wish to be contacted for marketing purposes, please email [email protected].

If you agree, Our Company will share your data with our partner companies so that they may offer you their products and services.

  • OpenAI, Anthropic, VoyageAI, Qdrant, etc.

You may request the current list of sub-processors by contacting [email protected]. All sub-processors are required to implement appropriate technical and organisational security measures in accordance with art. 32 GDPR.

When Our Company processes your order, it may send your data to, and also use the resulting information from, credit reference agencies to prevent fraudulent purchases.

How do we use artificial intelligence and make automated decisions

We use automated systems and artificial intelligence (AI) for:

  • Automatic analysis and extraction of CV information.
  • Automatic scoring and ranking of CVs.
  • Conducting preliminary AI-led interviews.
  • Producing summaries and matching suggestions for client employers/recruiters.

AI outputs (analysis, scores, recommendations) are provided for information only and do not constitute a guarantee of employment or an employment decision. They do not make final hiring decisions, nor do they have the authority to approve or reject candidates. Final decisions are made by the client employer/recruiter.

4.2 Legal Bases of Processing

We process your personal data on the following legal bases (Article 6 GDPR):

  • Performance of a contract (Art. 6(1)(b)) — to provide the services or products you have ordered.
  • Legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, or other statutory requirements.
  • Legitimate interests (Art. 6(1)(f)) — to improve our services, prevent fraud, and ensure IT security.
  • Consent (Art. 6(1)(a)) — for marketing communications and non-essential cookies.

5. Data Retention

We retain your personal data for as long as necessary for the stated purposes or as required by law:

  • Contractual data: for the duration of the contract + [X] years in accordance with legal obligations.
  • Billing and invoicing data: [X] years (per applicable tax legislation).
  • Marketing data: until consent is withdrawn.
  • Technical data (logs): [X] months.

Upon expiry of the applicable retention period, data will be securely deleted or anonymised.

How do we store your data?

Our Company securely stores your data at our data centre in Frankfurt.

Our Company will keep your data for as long as you use our services and have an account registered. Once this time period has expired, we will delete your data by deleting it from our servers.

We store your personal data only for as long as necessary to fulfil the purposes for which it was collected and in accordance with the principle of data minimization.

Candidate CVs and application forms are stored for up to 12 months from submission unless the candidate provides explicit consent for longer retention.

AI scoring results and preliminary interview recordings/transcripts/summaries are retained for up to 12 months and thereafter deleted or anonymized.

After the retention period expires, we will delete or anonymise personal data unless we are required to keep it for legal reasons.

We implement appropriate technical and organisational security measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These measures include the pseudonymisation and encryption of personal data, the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services, the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident, and a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing. The same is available for our sub-processors.

6. Recipients of Your Data (Who We Share It With)

Your data may be disclosed to:

  • IT and hosting service providers (data processors, bound by agreements pursuant to Art. 28 GDPR).
  • Payment processors and banking institutions.
  • Courier and logistics partners.
  • Public authorities (upon lawful request: tax authorities, courts, law enforcement).
  • Analytics and marketing platforms (e.g. Google Analytics, Meta Pixel) — only with your consent.

We do not sell your personal data to third parties.

7. International Data Transfers

Some of our service providers may be located outside the European Economic Area (EEA). In such cases, we ensure that transfers are carried out with appropriate safeguards, such as:

  • Standard Contractual Clauses approved by the European Commission.
  • European Commission adequacy decisions.
  • Other approved transfer mechanisms under GDPR.

8. Your Rights

Under the GDPR, you are entitled to the following rights:

  • Right of access (Art. 15) — to request a copy of the personal data we hold about you.
  • Right to rectification (Art. 16) — to correct inaccurate or incomplete data.
  • Right to erasure / “right to be forgotten” (Art. 17) — to request deletion of your data.
  • Right to restriction of processing (Art. 18) — to limit the way we process your data.
  • Right to data portability (Art. 20) — to receive your data in a structured, machine-readable format.
  • Right to object (Art. 21) — to object to processing for direct marketing purposes.
  • Right not to be subject to automated decision-making (Art. 22) — including profiling.
  • Right to withdraw consent — at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at: [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with the competent supervisory authority in your country of residence.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

  • Encryption of data in transit (HTTPS/TLS) and at rest.
  • Access controls and multi-factor authentication for internal systems.
  • Regular security audits and vulnerability assessments.
  • Data breach notification procedures (within 72 hours to the supervisory authority, pursuant to Art. 33 GDPR).

10. Cookies and Similar Technologies

We use cookies and similar tracking technologies. The categories of cookies we use are:

  • Essential — necessary for the website to function (no consent required).
  • Analytical — to understand how visitors use our website (requires consent).
  • Marketing — to deliver personalised advertising (requires consent).

You can manage your cookie preferences through the consent banner displayed on your first visit, or through your browser settings. For further details, please refer to our Cookie Policy, below:

What are cookies?

Cookies are text files placed on your computer to collect standard Internet log information and visitor behaviour information. When you visit our websites, we may collect information from you automatically through cookies or similar technology.

For further information, visit allaboutcookies.org.

How do we use cookies?

Our Company uses cookies in a range of ways to improve your experience on our website, including:

  • Keeping you signed in.
  • Understanding how you use our website.

What types of cookies do we use?

There are a number of different types of cookies, however, our website uses:

  • Functionality — Our Company uses these cookies so that we recognize you on our website and remember your previously selected preferences. These could include what language you prefer and location you are in. A mix of first-party and third-party cookies are used.
  • Advertising — Our Company uses these cookies to collect information about your visit to our website, the content you viewed, the links you followed and information about your browser, device, and your IP address. Our Company sometimes shares some limited aspects of this data with third parties for advertising purposes. We may also share online data collected through cookies with our advertising partners. This means that when you visit another website, you may be shown advertising based on your browsing patterns on our website.

How to manage cookies

You can set your browser not to accept cookies, and the above website tells you how to remove cookies from your browser. However, in a few cases, some of our website features may not function as a result.

11. Protection of Minors

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from minors. If you become aware that a minor has provided us with personal data without parental consent, please contact us so that we may delete the relevant information.

12. Changes to This Policy

We reserve the right to update this Privacy Policy periodically. Any material changes will be communicated via:

  • Email notification (where we hold your email address).
  • A notice banner on our website.
  • An update to the “Last Updated” date at the top of this document.

We encourage you to review this policy periodically.

13. Contact and Complaints

For any questions, requests, or complaints regarding the processing of your personal data:

Email: [email protected]

Call: +40 318 108 890

Address: Central Business Park, Calea Șerban Vodă nr. 133, Building A, ground floor, sector 4, Bucharest, Romania.

Competent supervisory authority (EU residents): you may lodge a complaint with the data protection authority in your EU Member State of residence. Full list of EU supervisory authorities: edpb.europa.eu/about-edpb/about-edpb/members_en.

Last Updated: 1 June 2026