Data processing policy

wherewework is committed to protecting your privacy. This Data Processing Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and what rights you have. It applies to all users of wherewework.com worldwide.

UNDELUCRAM SRL, the operator of wherewework.com and the data controller for personal data processed through the platform. We operate under the EU General Data Protection Regulation (GDPR) and applicable Romanian data protection law.

[email protected].

1. Who We Are (Data Controller)

UNDELUCRAM SRL

Registered address: Str. Regele Ferdinand nr. 22-26, Centrul Comercial Central, Floor 3, Cluj-Napoca, Romania

Mailing address: B-dul Iuliu Maniu 6L, Campus 6.1, Floor 3, Sector 6, Bucharest, Romania

Trade Registry: J12/2388/2019 | VAT: RO 37266398

[email protected]

2. What Data We Collect

2.1 Data You Provide Directly

Account registration data: name, email address, city of residence, and optionally a profile photo
CV data: work history, education, skills, and other information you include in a CV created or uploaded on the platform
User contributions: anonymous reviews, salary data, interview experiences, and other workplace content you submit
Job applications: if you apply for a job through the platform, we process the application data you submit
Communications: messages you send to us via email, support forms, or other contact channels
Employer or recruiter profile data: company name, contact information, and profile content submitted by employer or recruiter account holders

2.2 Data Collected Automatically

Technical data: IP address, browser type and version, operating system, device identifiers
Usage data: pages visited, time spent on the platform, links clicked, search queries
Cookie data: as described in our Cookies Policy

2.3 Data from Third Parties

Social login data: if you register using a social media account (e.g. Google, LinkedIn), we receive basic profile information from that service as permitted by your settings
Publicly available employer data: we may collect publicly available information about employers to create or enrich Employer Profiles

3. Why We Use Your Data (Legal Bases)

3.1 To Provide and Operate the Platform

We process your data to create and manage your account, display content, process job applications, and deliver the platform's core functionality. Legal basis: performance of a contract (Article 6(1)(b) GDPR).

3.2 To Ensure Platform Integrity & Safety

We use account data and activity logs to detect fraud, prevent abuse, enforce our Terms and Community Guidelines, and respond to legal requests. Legal basis: legitimate interests (Article 6(1)(f) GDPR) and legal obligation (Article 6(1)(c) GDPR).

3.3 To Communicate With You

We use your email address to send account-related notifications, updates to our Terms or Policies, and — where you have opted in — platform newsletters and product updates. Legal basis: contract performance and/or consent.

3.4 To Improve the Platform

We analyse aggregated, anonymised usage data to understand how the platform is used and to improve features and content. Legal basis: legitimate interests.

3.5 Employer & Recruiter Services

For employer and recruiter account holders, we process business contact and profile data to deliver paid services and manage the commercial relationship. Legal basis: contract performance.

3.6 Legal Compliance

We may process data to comply with legal obligations, respond to court orders, or cooperate with regulatory or law enforcement authorities. Legal basis: legal obligation.

4. Anonymity of User Contributions

All workplace reviews, salary submissions, and interview experiences published on wherewework.com are anonymous. Your name and identifying information are never displayed publicly in connection with your contributions.

However, we retain the link between your account and your contributions internally for moderation, integrity, and legal compliance purposes. In response to a valid legal order, or where there is credible evidence of serious harm caused by a specific contribution, we may be required to disclose account information to competent authorities.

5. Who We Share Your Data With

We do not sell your personal data. We may share data with:

Service providers and processors: cloud hosting providers, email delivery services, analytics tools, and payment processors, all operating under data processing agreements and bound by confidentiality obligations
Employers and recruiters: if you apply for a job through the platform, your application data is shared with the relevant employer or recruiter
Legal authorities: where we are required to do so by law, court order, or to protect the rights and safety of our users or the public
Business transfers: in the event of a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction, subject to the protections of this policy

All international data transfers outside the European Economic Area are conducted in accordance with GDPR Chapter V, using standard contractual clauses or other approved transfer mechanisms.

6. Data Retention

We retain your personal data for as long as your account is active, and for a reasonable period thereafter as necessary for legal, compliance, or business purposes. Specifically:

Account data: retained for the duration of your account and for up to 3 years after account closure
User contributions: retained for the duration of the platform's operation in aggregated form; linked account data deleted on request
Application data: retained for up to 1 year following the application, unless a longer period is required by law
Technical and usage logs: retained for up to 12 months

You may request deletion of your personal data at any time, subject to our legal retention obligations.

7. Your Rights

Under the GDPR and applicable law, you have the following rights in relation to your personal data:

Right of access: request a copy of the personal data we hold about you
Right to rectification: ask us to correct inaccurate or incomplete data
Right to erasure: request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations
Right to restriction: ask us to restrict the processing of your data in certain circumstances
Right to data portability: receive your data in a structured, machine-readable format
Right to object: object to processing based on legitimate interests or for direct marketing
Right to withdraw consent: where processing is based on your consent, withdraw it at any time without affecting past processing

[email protected]. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Romanian data protection authority (ANSPDCP) at www.dataprotection.ro, or with the supervisory authority in your country of residence.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include encryption in transit and at rest, access controls, and regular security reviews.

No system is completely secure. If you suspect unauthorised access to your account, please contact us immediately at [email protected].

9. Cookies

Cookies Policy.

10. Children

wherewework is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a person under 18, please contact us at [email protected] and we will delete it promptly.

11. Changes to This Policy

We may update this Data Processing Policy from time to time. Material changes will be communicated to registered users by email at least 15 days before taking effect. The current version is always available at wherewework.com.