Compliant with EU Regulation 2016/679 (GDPR)
Informational translation — the Romanian version prevails
This is an informational translation provided for convenience. The Romanian version of this document is the sole legally binding version. In case of any discrepancy between the Romanian and English versions, the Romanian version shall prevail.
This document is governed by Romanian law. Any disputes arising from or related to it are subject to the exclusive jurisdiction of the Romanian courts.
Privacy Policy
We clearly explain what data we collect, why, how long we retain it, and what rights you have. No unnecessary legal jargon. This policy applies to both companies (B2B) and individuals (B2C).
Last updated: 4 July 2026
1.Cine suntem
Platforma JobGrade is operated by:
Psihobusiness Consulting SRL
- CUI: RO15790994
- Registered office: Str. Viitorului no. 20, Roșu, Ilfov, postal code 077042
- Email: contact@jobgrade.ro
- Website: https://jobgrade.ro
JobGrade is a SaaS platform dedicated to companies in Romania, offering job evaluation and grading services, salary analysis, and compliance with EU Directive 2023/970 on pay transparency.
2.What data we collect
2.1. Data you provide directly (B2B — companies)
- Cont: email, first name, last name, job title (optional), password (stored exclusively as a hash — we cannot see or recover it)
- Profil companie: company name, tax ID (CUI), Trade Register number, address, county, NACE code, industry, size, website, mission, vision, values (optional)
- Date salariale: employee code (internal, no name or national ID number), job title, department, base salary, allowances, benefits, gender, seniority, education — data is imported pseudonimizat
- Art. 7 pay transparency requests: email angajat solicitant + detalii cerere
2.2. Data you provide directly (B2C — individuals)
Privacy by design: the B2C account uses a pseudonim ales de utilizator. Real identity (email + name) is stored separately from interaction content; AI agents do not know your real identity.
- Cont B2C: email + pseudonym (identity layer, isolated); password stored as a hash
- Profil B2C: questionnaire responses (Profiler), professional aspirations, life situations (at the user's discretion) — all under a pseudonym
- Conversations with AI agents: dialogue log with specialised agents (guides on thematic cards, Personal HR Consultant)
- Optional CV: if the user uploads it for the "Career" card (automatic extraction into an anonymised job profile)
- Thematic communities: content of messages posted under a pseudonym
- Optional demographic data (date of birth, gender): only if you choose to provide them at registration, based on your consent, for a personalised development plan (identifying areas where you excel and areas for improvement) and an anniversary gift. You may leave them blank or delete them at any time; your account works without them.
2.3. Date generate prin utilizarea platformei
- Scores across the 6 evaluation criteria, justifications, votes, decisions
- Conversations with the AI assistant (prompts + responses)
- Rapoarte generate (ierarhizare, grade, pay gap, KPI)
2.4. Date colectate automat
- Session cookie (required for authentication)
- JWT token (for maintaining the session)
- Technical logs (IP, browser agent) — for security
We do not use: marketing cookies, Google Analytics, Facebook Pixel, or any other third-party tracking tools.
3.Why we collect this data
| Scop | Why |
|---|---|
| Account and authentication | To access the platform |
| Evaluare posturi | Serviciul principal |
| Salary structure analysis | Calculation of grades, steps and disparities |
| Decalaj salarial UE 2023/970 | Legal obligation |
| Cereri Art. 7 | Employees' legal right |
| Analize AI | Content generation, KPIs |
| Notifications | Evenimente importante |
| Facturare | Payment processing (Stripe) |
| Securitate | Prevenire acces neautorizat |
| Plan evolutiv personalizat (B2C) | With consent — excellence directions and areas for improvement, from optional demographic data |
| Cadou aniversar (B2C) | With consent — based on optionally provided date of birth |
| De-identified statistical research | Aggregate patterns for platform improvement (Art. 89 — no individual identification) |
4.Legal basis
Pursuant to Art. 6 GDPR, we process your data on the basis of:
- Performance of a contract (Art. 6.1.b) — for the delivery of JobGrade services
- Legal obligation (Art. 6.1.c) — conformitate UE 2023/970, Codul Muncii, GDPR, AI Act
- Interesului legitim (Art. 6.1.f) — security, product improvement, anti-fraud protection
- Consent (Art. 6.1.a) — for optional communications (newsletter) and for optional B2C demographic data (date of birth, gender), used to personalise the development plan and anniversary gift; you may withdraw it at any time
Profiling without automated decisions: B2C personalisation uses profiling (cohort patterns), but pasiv — no outcome automatically produces legal or similarly significant effects on you (Art. 22). Research observations are de-identified; decisions remain yours.
5.Who we share data with
Your data is processed by us and a limited set of sub-processors, each with a signed DPA agreement under Art. 28 GDPR:
What we do not do
- We do not sell personal data to third parties
- We do not train AI models on customer data
- We do not share data for third-party marketing
6.How long we retain data
| Categorie | Termen |
|---|---|
| Active account (B2B or B2C) | For the duration of use |
| Cont B2B inactiv | 36 months from last activity, with notification at 24 months |
| Cont B2C inactiv | 3 years from last activity, notification at 24 months, deletion at 36 |
| Date evaluare B2B | Durata contractului + 5 ani |
| AI B2C conversations (under pseudonym) | 3 ani de la ultima activitate |
| Date facturare | 10 ani (Codul Fiscal) |
| Loguri securitate | 12 luni |
| Audit trail GDPR | 10 ani |
7.Your rights
Dreptul de acces
Request a copy of all personal data we hold about you (Art. 15)
Dreptul la rectificare
Correct inaccurate or incomplete data (Art. 16)
Right to erasure
Request erasure of your data (Art. 17 — "right to be forgotten")
Right to restriction
Restrict processing in certain circumstances (Art. 18)
Dreptul la portabilitate
Receive your data in a structured, machine-readable format (Art. 20)
Right to Object
You may object to processing based on legitimate interest (Art. 21)
Dreptul Art. 22
Not to be subject to a decision based solely on automated processing
Right to Lodge a Complaint with a Supervisory Authority
Contact your national data protection authority (e.g. via www.edpb.europa.eu)
How to exercise your rights
Send a request to dpo@jobgrade.ro with a clear description of your request. We respond within 30 days, free of charge (except for manifestly unfounded or excessive requests).
8.Transfers outside the EU
The only transfer of personal data outside the EU is to Anthropic (USA), for AI prompt processing.
Safeguards for the Anthropic transfer
- Standard Contractual Clauses (SCC) approved by the European Commission
- Data Privacy Framework (DPF) — Anthropic certified for EU→US transfer
- Zero retention: Anthropic does not train models on our data
- By design: we do not send direct personal data in prompts (national ID, names, gross salaries) — only aggregates or job data without identifiers
- Audit trimestrial al fluxurilor de date trimise
9.Securitate
We apply technical and organisational measures in accordance with Art. 32 GDPR:
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- bcrypt hash for passwords (cost factor 12)
- JWT token with validation on every request against the database
- Access restricted on a "need to know" basis
- Encrypted daily backups, 30-day retention
- Audit logs for all administrative access
- Incident response in accordance with Art. 33 — ANSPDCP notification within 72h
10.Servicii Google / YouTube (API)
Consola noastră internă de marketing folosește YouTube API Services (Google) pentru a publica pe canalul YouTube propriu JobGrade materiale video proprii și pentru a confirma canalul conectat. Accesul este strict first-party: aplicația publică și citește date doar pentru canalul care a autorizat-o (al nostru).
Ce date Google accesăm și de ce
- youtube.readonly — numele și ID-ul canalului conectat, afișate în panoul intern pentru ca operatorul să confirme pe ce canal se publică (și pentru verificarea stării încărcării).
- youtube.upload — încărcarea fișierelor video proprii pe canalul JobGrade.
- NU accesăm date ale altor utilizatori/canale, comentarii, abonați sau conținut al terților.
Stocare, partajare, revocare
- Tokenul OAuth Google este stocat securizat și folosit exclusiv pentru publicarea pe canalul propriu; nu stocăm alte date YouTube dincolo de ID-ul/numele canalului pentru afișare.
- Nu partajăm datele primite de la API-urile Google cu terți și nu le folosim pentru publicitate.
- Puteți revoca accesul oricând din Google Account → Permisiuni sau din consola internă („Deconectează").
Limited Use: utilizarea și transferul de către JobGrade a informațiilor primite de la API-urile Google respectă Google API Services User Data Policy, inclusiv cerințele Limited Use. Aplicabile și Termenii YouTube + Politica de confidențialitate Google.
11.Policy updates
We reserve the right to update this policy. For significant changes, we will notify you by email at least 30 days before they take effect. The current version is always available at jobgrade.ro/privacy, and previous versions are archived upon request.
12.Contact
Operator de date
- Psihobusiness Consulting SRL
- contact@jobgrade.ro
Data Protection Officer
Autoritate supraveghere
Document drafted in accordance with Regulation (EU) 2016/679 (GDPR) and Law no. 190/2018 on its application in Romania.