Privacy Policy
This policy explains how NEXTCALL ROMANIA S.R.L. processes personal data in connection with the CVShortlist service (cvshortlist.ai), in accordance with the EU General Data Protection Regulation (GDPR) 2016/679.
1. Who we are (data controller)
Registered office: Str. Traian nr. 27, bl. A8, sc. A, et. 4, ap. 13, cod postal 610137, Piatra Neamt, jud. Neamt, Romania
VAT: RO49309158 · Company reg. no.: J27/1262/2023 · EUID: ROONRC.J27/1262/2023
Legal representative: Marius Herdes
Data protection contact: contact@cvshortlist.ai
2. Our role: controller or processor
- Controller — for data of our visitors and customers: lead form data, account data, business correspondence.
- Processor — for the candidate data contained in the CVs that our customers upload for analysis. In that case the customer is the controller and we process such data only on their instructions, under the Data Processing Agreement.
3. What we collect and why
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Lead form data | name, email, company, role, number of CVs, phone, IP address | To contact you about CVShortlist and the free trial; abuse prevention | Consent (Art. 6(1)(a)) and legitimate interest (Art. 6(1)(f)) |
| Account data | email, password (stored hashed), company name | Create and manage your account, authentication | Performance of a contract (Art. 6(1)(b)) |
| Usage data | jobs created, CVs uploaded, minimal technical logs | Providing and securing the service | Contract and legitimate interest |
| Candidate CVs (on behalf of the customer) | data in CVs uploaded by the customer | Matching analysis and scoring, on the customer's instructions | Customer is the controller; see DPA |
We do not intentionally collect special categories of data (Art. 9 GDPR). Please do not submit such data through our forms.
4. Who we share data with (processors)
| Provider | Role | Location |
|---|---|---|
| ROMARG | Web hosting for sites and forms | Romania (EU) |
| Hetzner | Application and database hosting | Germany / EU |
| Anthropic PBC (Claude API) | Automated analysis of CV text | USA |
5. International transfers
CV analysis uses Anthropic (Claude API), which may process data in the United States. Such transfers rely on the Standard Contractual Clauses approved by the European Commission and appropriate supplementary measures. Contact contact@cvshortlist.ai for details.
6. Retention
- Lead data: up to 24 months from last contact, or until consent is withdrawn.
- Account data: for the life of the account; deleted within 30 days of account closure, subject to legal retention obligations.
- Candidate CVs: per the customer's (controller's) instructions; by default deleted when the candidate/job is deleted or the contract ends.
7. Your rights
You have the right to access, rectification, erasure, restriction, data portability, objection, and to withdraw consent at any time. To exercise your rights, contact contact@cvshortlist.ai. You may also lodge a complaint with your local supervisory authority; in Romania this is ANSPDCP (www.dataprotection.ro).
8. Cookies
We use a minimal set of cookies. See our Cookie Policy.
9. Security
We apply appropriate technical and organisational measures: password hashing, HTTPS, tenant data isolation, restricted access, and effective file deletion on request.
10. Changes
We may update this policy. The version in force is the one published on this page, with the date shown above.