TERMS AND CONDITIONS FOR REGISTERED EMPLOYERS FOR USING THE CV SERVICES

1              GENERAL

1.1          These Terms and Conditions constitute a legally binding agreement between CV-Online and Customer, relating to the use of the Services and personal data processing thereof. By opening an account, Customer confirms that it fully agrees to all the terms and conditions stipulated herein. In case Customer does not agree to the Terms and Conditions, the Customer may not use the Services.

2              DEFINITIONS

2.1          CV-Online – CV-Online Estonia OÜ (registry code 10166144, registered office Pärnu mnt 158/1, 11317 Tallinn, Republic of Estonia).

2.2          Customer – a legal or natural person ordering Services.

2.3          Parties – CV-Online and the Customer.

2.4          Website – the online site created for providing Services related to mediation of jobseekers and employers administered by CV-Online at the address www.cv.ee. The Website contains job offers and job-seeking notices, CVs and other data related to employment.

2.5          Database – the CV-Online database located on the Website.

2.6          GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data and repealing Directive 95/46/EC. Unless expressly stated otherwise in these Terms and Conditions, any term shall have the same meaning as stipulated in the GDPR.

2.7          Access Data – the username and password to be communicated by CV-Online to the Customer that are required for accessing the Database.

2.8          Terms and Conditions – these terms and conditions for registered employers for using the CV-Online Database.

2.9          Advertisement – a Customer’s job offer advertisement published in the Database.

2.10        Services – services, including Ad Service and Database Service, aimed at employers as described in the subdivision “Order services” of the section “Employer” of the Website that CV-Online provides to the Customer and for which the Customer pays CV-Online pursuant to the rates provided in the same subdivision.

2.11        Ad Service – a service provided by CV-Online to the Customer, which allows the Customer to publish its job vacancies Advertisements using the Website as a platform, and the job seekers’ applications are transmitted, i.e. either received and stored with, via CV-Online and then forwarded to the Customer or sent directly to the Customer. Ad Service may be included as part of other Services provided by CV-Online.

2.12        Database Service – a service provided by CV-Online to the Customer, which entails giving an access to the Customer to the Database, which contains CVs of all currently active job seekers (the status of a job seeker is defined by CV-Online in accordance with its internal policies and legal relationship with this respective job seeker). Database Service may be included as part of other Services provided by CV-Online.

3              RIGHTS AND OBLIGATIONS OF CUSTOMER REGARDING THE SERVICES

3.1          If the Customer has paid for the ordered Services or CV-Online has decided to provide Services to the Customer on the basis of credit, CV-Online shall e-mail them data concerning the activation of the access rights to the Database and the Access Data ensuring them the possibility to use the Services during the period of time set out in the description of the respective Service.

3.2          The Customer shall be entitled to disclose their Access Data only to authorised contact persons for the purpose of using the ordered Services, for example their employees through whom the Customer uses the Services.

3.3          The Customer shall be responsible for ensuring that their Access Data are inaccessible to any third parties. If the Customer has a reason to suspect that the Access Data have been made available to third parties, they shall immediately notify CV-Online thereof via e-mail. In this case, CV-Online shall invalidate the Customer’s Access Data and issue new Access Data. The aforesaid data shall be sent in writing to the e-mail address submitted by the Customer upon registration or communicated in another manner agreed on with the Customer via e-mail.

3.4          The Customer shall inform CV-Online via e-mail within three working days of any changes in the contact person of the Customer, setting out the date as of which the former contact person no longer has the authorisation to use the Database Service on behalf of the Customer, as well as the name of the new contact person, and also give notice of the date as of which the new contact person is granted the authorisation to use the Database Service on behalf of the Customer, e-mail address and telephone number of the new contact person. After receiving a respective notice from the Customer, CV-Online shall invalidate the former Access Data on the date specified by the Customer and submit new Access Data to the Customer’s new contact person’s e-mail address.

3.5          The Customer shall use the data gathered from using the Database Service only for their own purposes with the objective of finding employees and not communicate it or any parts of it to any third parties without the written approval of CV-Online. As an exception, staff recruitment agencies are permitted to communicate information to their contractual partners for the purpose of offering employment mediation services. Staff recruitment agencies must ensure that their customers only use the data of jobseekers pursuant to the objectives and extent provided in the Terms and Conditions and apply similar technical and organisational measures for protecting the personal data of jobseekers as provided in the Terms and Conditions.

3.6          The Customer shall not perform any activities with the aim of copying or damaging the Database and/or the Website in part or in full or interrupting the operation thereof, including, but not limited to, via any computer programs (applications, scripts, command prompt queries, etc.).

3.7          Whilst using the Ad Service, the Customer shall be able to use one Advertisement for publishing only one job offer. The Advertisement must comply with the requirements of legislation and contain accurate and reliable information that corresponds to the ethical and moral standards prevalent in society. The Customer shall be responsible for the content of the Advertisement.

3.8          The Advertisement must only contain the Customer’s contact details. Including the contact details of any third parties in the Advertisement shall only be permitted upon a previous agreement with CV-Online concluded via e-mail or signed in writing.

3.9          If not allowed otherwise by CV-Online, the Advertisement may not contain the employer’s e-mail address, i.e. applying for the job must take place through the CV-Online system. However, different rules may apply across the jurisdictions CV-Online operates, therefore, the Customer should contact the respective CV-Online entity.

3.10        The Customer authorises CV-Online to inspect the Advertisements and the information contained therein in information channels not controlled by the Customer. The authorisation of CV-Online set out in this clause shall not restrict the Customer’s rights, i.e. the Customer shall be entitled to also publish Advertisements and the information contained therein in other information channels independently or via representatives. Upon the illegal copying or publishing of Advertisements and the information contained therein or making them available to unauthorised persons in any other manner in information channels whose administrators are not CV-Online or its partners, the Customer authorises CV-Online to take any required legal measures in order to stop the illegal use and publication of the data contained in the Database.

3.11        The Customer shall be entitled to order additional Services at any time, including the extension of the period of access to the Database and/or increasing the number of Advertisements.

4              RIGHTS AND OBLIGATIONS OF CV-ONLINE

4.1          CV-Online shall ensure the provision of the Services chosen by the Customer pursuant to the terms and conditions set out in the description of the Services after the receipt of the fee from the Customer.

4.2          For the purpose of using the Services, CV-Online shall send a notice to the Customer’s e-mail address registered in the Database concerning the activation of access to the Database by means of which the Customer shall receive the Access Data.

4.3          CV-Online shall ensure the uninterrupted operation of the Database and the accessibility of the data entered in the Database online 24 hours a day. If access to the Database is interrupted due to the acts or omissions of CV-Online (including its employees, contractors and/or subcontractors), CV-Online shall, at the request of the Customer, extend the period of using the Services proportionately to the period of time in which access to the Services was interrupted. Should CV-Online foresee that using the Services may be interrupted, it shall inform the Customer’s contact person thereof in due time.

4.4          CV-Online shall be entitled to demand that the Customer removes an Advertisement entered in the Database if it contains information that is contrary to these Terms and Conditions and the legislation of the Republic of Estonia. If the Customer fails to make the required amendments to the Advertisement within two working days, CV-Online shall be entitled to remove the Advertisement from the Database. CV-Online shall not be liable for any damage caused to the Customer arising from such removal. CV-Online shall also be entitled to unilaterally remove any Advertisements that are not job offer advertisements and any job offer advertisements that are not in compliance with the applicable legislation and moral standards or are clearly related to activities leading to a violation of human rights (human trafficking, enslaving, etc.).

4.5          CV-Online shall be entitled to change the Database procedures and menu structure without giving the Customer prior notice.

4.6          All rights to the Database belong to CV-Online. The Customer may only use the data contained in the Database for the purpose of using the Services within the scope set out in the description of the Services ordered by the Customer. When using the Database in any manner whatsoever (including for the purpose of using the Services), the Customer shall not receive the copyright to the software required for the operation of the Database.

4.7          CV-Online shall be entitled to unilaterally amend these Terms and Conditions, giving notice of the amendments and making the new Terms and Conditions available on the Website at least five days before the entry into force of the amendments.

5              PRIVACY STATEMENT

5.1          For the provision of the Services to the Customer, CV-Online is processing the personal data of the following data subjects: Customer’s representatives/employees whose personal data is processed while registering for the Services and while providing the Services.

5.2          The Customer is aware that it, as a legal entity, is considered to be a data controller regarding its employees, management board members and other natural persons who represent the Customer and through whom the Customer is entitled to use the Service.

5.3          Therefore, the Customer is required to provide to the foregoing persons all the relevant notices and/or obtain all necessary consents, or ensure the existence of other legal grounds, for the processing of the said personal data by CV-Online for providing the Service to the Customer.

5.4          In case, despite the correct fulfilment of the obligations by the Customer as stated in Section 5.3 above, CV-Online is considered to be a data controller regarding the Customer’s representatives/employees whose personal data is processed while registering for the Services and while providing the Services, CV-Online hereby, in this privacy statement (the “Privacy Statement”), informs the affected natural person of the processing of his/her personal data (the “Affected Person”). The Customer is obliged to make the information presented herein known to the Affected Person.

5.5          CV-Online processes the Affected Person’s personal data only for the preparation, execution and ensuring the execution of the Terms and Conditions, as concluded with the Customer, and for the provision of the Services to the Customer. CV-Online may also process the personal data of the Affected Person for: (i) commencing any legal actions against, or defending itself against any legal actions by, the Affected Person or the Customer; and (ii) for providing and administering the Services.

5.6          All the processing activities for the purposes described under Section 5.5 are done under the legitimate interest of CV-Online and the Customer. The legitimate interests of the Customer and CV-Online are to ensure the fulfilment of the Terms and Conditions, enforcing any rights deriving from applicable legislation and to enable direct and clear communication between the Customer and CV-Online via the Affected Person, taken into account the position of the Affected Person in the Customer’s organization.

5.7          The personal data of the Affected Person may be accessible to the sub-processors of CV-Online, who are used for the provision of the Service.

5.8          The provision of the personal data by the Affected Person is not mandatory, however, not presenting such data affects CV-Online’s possibility to conclude the Terms and Conditions with the Customer, meaning, that CV-Online is not able to provide the Services to the Customer, which may result the Affected Person facing legal or other consequences on behalf of the Customer.

5.9          Under the applicable legislation, the Affected Person has the right to request the following rights to be exercised by CV-Online: the right to request access to the personal data and rectification or erasure of personal data or restriction of processing concerning the Affected Person or to object to the processing of the personal data and to lodge a complaint to the respective supervisory authority. The Affected Person takes note that he/she may be limited in exercising of the foregoing rights, as described under applicable legislation.

5.10        As the personal data regarding the Affected Person is processed in relation to the documentation of the Terms and Conditions and any legal claims which may arise from the foregoing, then the personal data of the Affected Person is processed as long as the foregoing documentation is retained, and any legal claims are expired under applicable legislation. The Agreement and any related documentation is retained for a period of maximum 10 years, taken into account the expiration of the possible legal claims.

6              THE PROCESSOR AND CONTROLLER OF THE PERSONAL DATA AND SPECIFICATION OF PERSONAL DATA

6.1          Depending on which of the Services the Customer will use, the data processing roles of the Customer and CV-Online are defined as follows:

6.1.1      The Ad Service:  For the purposes of finding a suitable employee via the Ad Service, the Customer is the data controller and CV-Online is the data processor of the processing activities regarding the personal data of job seekers, who have applied to the vacancies published by the Customer.
For the purposes of providing the Ad Service, CV-Online, as the data processor, will process the personal data of job seekers only to the extent it is necessary for transmitting the job applications via the processor’s systems to the controller’s possession.
The Customer, as a data controller, is required to ensure that it will fulfil, in relation to the relevant job-seeker, all the necessary notification and other requirements, deriving from the applicable data protection legislation, including the need to ensure the existence of relevant legal grounds for the processing of the job seeker’s personal data by the Customer. The Customer shall take note that in case the applicant is a registered and logged in job seeker his/her personal data which has been transmitted to the Customer, may be processed by CV-Online for other purposes which derive from the agreement concluded between CV-Online and the job seeker.
In order to provide the Ad Service, CV-Online processes job seekers’ personal data that does not belong to the special categories of personal data and which comprises of personal data, made available to CV-Online by the job seeker, including but not limited to: e-mail address, full name, phone number, and other personal data provided in job seeker’s CV whilst applying for a specific position. CV-Online shall process the personal data for which the Customer is the controller while providing the Ad Service, and also after that, if it is required by applicable laws, for the purposes and to the extent stipulated herein.

6.1.2      The Database Service: For the purposes of finding a suitable employee via the Database Service, the Customer is a separate data controller from CV-Online regarding the personal data of the active job seekers, whom CVs are displayed in the Database.
For the purposes of providing the Database Service, CV-Online is processing the personal data of all job seekers registered with CV-Online via the Website. Regarding the said job seekers’ personal data, CV-Online is deemed to be a data controller (a separate one from the Customer). CV-Online, as a controller is processing the job seekers’ personal data under a separate agreement concluded between CV-Online and the job seeker.
CV-Online grants the access to the Database for the Customer only for employment-related purposes. The Customer is aware and acknowledges that it, as a data controller, takes full responsibility for the processing of any personal data contained in the Database for any purposes and through any means the Customer has foreseen.

6.1.3      The Services: In case the Customer wishes to access the Services, then, if the Services consist of the Ad Service and the Database Service, the Customer is deemed to be a data controller and CV-Online is deemed to be data processor in regard to the Ad Service and the Customer and CV-Online are considered to be independent data controllers in regard to the Database Service. The respective purposes and scope are defined in Sections 6.1.1. and 6.1.2. of these Terms and Conditions.

6.2          In the context of services mentioned in Sections 6.1.1.-6.1.3., the Customer as a controller, is required to ensure that it will fulfil, in relation to the relevant job seekers, all the necessary notification and other requirements, deriving from the data protection legislation, including the need to ensure the existence of relevant legal grounds for the processing of the job seeker’s personal data.

7              OBLIGATIONS OF CV-ONLINE AS PERSONAL DATA PROCESSOR

7.1          The current Section is applicable for the provision of Ad Service (separately or part of the Services) only, as provided by CV-Online.

7.1.1      If CV-Online acts as a data processor for the purposes of the Ad Service, CV-Online shall:

7.1.1.1     process the personal data solely on behalf of the controller, on the basis of reasonable instructions given by the Customer, in accordance with the data protection legislation and the Terms and Conditions, to the extent necessary for the performance of the Services;  

7.1.1.2     process the personal data only on documented instructions given by the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by European Union or Estonian laws to which the processor is a subject. In such a case, the processor shall promptly inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;

7.1.1.3     transfer personal data to third countries provided that it applies any of the appropriate safeguards, as stipulated in Article 46 of GDPR;

7.1.1.4     ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

7.1.1.5     apply all reasonable security measures, as required pursuant to the data protection legislation, including to the maximum extent the measures stipulated in Article 32 of the GDPR;

7.1.1.6     assist the controller by appropriate technical and organisational measures for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in the data protection legislation, including the obligations in Chapter III of the GDPR;

7.1.1.7     assist the controller in ensuring compliance with the obligations laid down in the data protection legislation, including in the Articles 32-36 of the GDPR, insofar it is possible and not unreasonably burdensome;

7.1.1.8     during the term of providing the Ad Service, if the functionality of the Ad Service does not include the option for Customer to delete the personal data, comply with any reasonable request from the Customer to facilitate such deletion, insofar as it is possible taking into account the nature and functionality of the Ad Service and unless applicable legislation requires retention of such data,  The Customer shall take note that CV-Online is retaining the personal data for a period of 3 years after the end of the respective Ad Service.

7.1.1.9     make available to the controller all information necessary to demonstrate compliance with the obligations deriving from the Terms and Conditions and data protection legislation, and contribute to audits, including inspections, conducted by the Customer or auditor mandated by the Customer. The Customer shall cover the expenses relating to the aforementioned audit and informs CV-Online about the audit at least 20 working days in advance.

7.1.2      CV-Online shall notify the Customer promptly, but not later than within 48 hours after:

7.1.2.1     becoming aware of a personal data breach; or

7.1.2.2     if in its opinion an instruction given by the Customer infringes the data protection legislation.

7.1.3      CV-Online is allowed to engage other processors without Customer’s prior written consent. CV-Online shall notify Customer of the identities of the processors, if requested by the Customer. If CV-Online engages another processor, it shall:

7.1.3.1     engage processors, that provide sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of data protection legislation and the protection of the data subject’s rights; and 

7.1.3.2     make reasonable efforts to oblige such processor, through concluding a contract, to fulfil obligations equivalent to that agreed herein.

7.2          CV-Online, as a processor in the provision of Ad Services, is aware that it is fully reliable for the performance and non-performance of the processor(s) engaged, to the extent the processor breaches the data protection legislation.

7.3          CV-Online, as a processor in the provision of Ad Services, is aware that pursuant to Article 28(10) of the GDPR, if the processor exceeds the scope of the powers given herein and processes the personal data for other purposes, then the processor shall be considered to be a controller in respect of that processing.

8              LIABILITY OF PARTIES

8.1          CV-Online shall be entitled to unilaterally terminate the provision of Services without providing an advance notice and without refunding the Customer the fee paid for the Services if the Customer has violated these Terms and Conditions and has failed to eliminate the violation within 10 working days as of the receipt of a respective warning from CV-Online via e-mail.

8.2          The Customer shall be entitled to waive the further use of the Services at any time irrespective of the reason by notifying CV-Online thereof via e-mail. In this case, the Customer shall not be entitled to demand that the fee paid for the Services be refunded.

8.3          The Customer shall be liable for the damage caused to CV-Online by violating these Terms and Conditions.

8.4          CV-Online shall not be liable for the accuracy or content of the data entered in the Database or any damage caused to the Customer as the result of using the data contained in the Database. The Customer shall conclude precontractual negotiations with jobseekers and enter into contracts with them independently without the intermediation of CV-Online.

8.5          Both Parties, if acting as data controllers, are liable towards each other for any damages they have caused to the other Party, regarding the processing of personal data, which derive from any breaches of the data protection legislation and any claims made by the data subjects. CV-Online, as a data processor, shall only be liable for any direct monetary damages, excluding any economic (loss of profit), indirect or any other damages, which derive from breaches of data protection legislation it has caused due to its own actions or inactions.

9              FINAL PROVISIONS

9.1          After the expiry of the period for using the Services, the Customer shall be unable to use the respective Services, but they shall retain access to the data they have entered in the Database (Advertisements and letters sent to applicants).

9.2          If the Terms and Conditions provide that CV-Online must be given notice via e-mail, the Customer shall send such notices to the e-mail address of the customer administrator assigned by CV-Online and a copy of the e-mail to info@cv.ee.

9.3          The Parties shall attempt to resolve any disputes arising in the course of the performance of their obligations by way of negotiations. Failing agreement, the dispute shall be resolved in the Harju County Court in compliance with the legislation of the Republic of Estonia.