Privacy Policy

The controller of your personal data is BITARCON S.R.L., the company that operates the Aravela platform. It is registered in Romania under number [registration number], with its registered office at [registered office].

For any question about your data, or to use any of your rights, write to [email protected]. For anything else, write to [email protected].

If you are a job seeker or a professional

Account:

your name, email address, password (stored only as a one-way hash) and phone number.

Profile:

date of birth, gender, city, the roles you want, departments, seniority, years of experience, skills, certificates (for example food hygiene), languages, education, work history, a short presentation and, if you add them, hobbies.

CV:

the file you upload and the details we read from it.

Photos:

your profile photo and any other photos you add to your profile.

Availability:

the days and hours you can work, your preferred type of contract, where you want to work and whether you would travel or relocate.

Pay expectations:

the salary or rate you ask for.

Review and interviews:

our review notes, interview times, the questions asked and the evaluations written by our interviewers.

Work records:

contracts, timesheets, holiday requests, expenses and receipts, equipment handed to you, health and safety records, training and evaluations.

Documents you upload when the law or a contract requires them:

identity card, diplomas, criminal record certificate, occupational medicine certificate, psychological evaluation, proof of address, bank statement, birth or marriage certificates, health insurance declarations, and your payslips.

Signed agreements:

the non-disclosure agreement and contracts you sign, with the evidence of signing described below.

If you use Aravela for a business

Your details:

name, job title, business email address and phone number.

Business details:

company name, registration and VAT numbers, address, venues, website and description.

Requests and engagements:

the staff you ask for, interviews, contract requests, approved timesheets, invoices and payment status.

Your team:

the colleagues you invite to use Aravela with you.

From everyone who uses Aravela

Messages and calls:

chat messages, files you send in chat, call and meeting history (who took part and when), and support requests.

Signatures:

when you sign a document: the time, your account, your IP address, your browser and a fingerprint (hash) of the exact text you signed.

Technical data:

IP address, browser and device type, time zone, sign-in times and security logs.

Notification settings:

which emails, text messages and push notifications you want, and the push subscription of each device where you allow them.

When you upload a CV, we send it to Google’s Gemini service, which reads it and returns the details (work history, skills, languages, education) so you do not have to type them. Google acts as our processor: it handles the file only to give us that answer. You can correct anything it reads before you save your profile.

Our interviewers can use an assistant that suggests interview questions. It receives a summary of your experience and skills with your name, contact details, photo, employers, schools and places removed.

Businesses can use Smart Match, which ranks published profiles against a role they describe. The ranking is a suggestion. Every decision that matters to you (approving you, rejecting you, publishing your profile, offering or ending an engagement) is made by a person at Aravela or at the business. We do not make decisions about you by automated means alone.

We use personal data only for the purposes below, each with its legal basis under Article 6 of the GDPR:

Running your account and the platform:

creating your account, signing you in, showing your dashboard, chat, calls and meetings. Basis: our contract with you.

Reviewing job seekers:

reading your profile and CV, holding interviews, approving or rejecting your application. Basis: steps you ask us to take before a contract.

Introducing professionals to businesses:

publishing approved profiles, matching them to requests, arranging interviews. Basis: our contract with you and with the business.

Contracts, timesheets, payroll and invoices:

preparing and signing contracts, recording hours, paying professionals, invoicing businesses. Basis: contract, and our legal duties under labour, tax and accounting law.

Notifications:

emails, text messages and push notifications about your account and your work. Basis: contract; optional notifications follow your settings.

Security and fraud prevention:

protecting accounts, keeping security logs, investigating misuse. Basis: our legitimate interest in a safe service.

Improving Aravela:

understanding which parts of the service work and fixing what does not. Basis: our legitimate interest.

Legal claims and authorities:

keeping evidence, answering lawful requests. Basis: legal obligation or legitimate interest.

Some documents contain special categories of data: an occupational medicine certificate or a psychological evaluation is health data, and a criminal record certificate is data about convictions. We ask for them only where Romanian labour law or the role requires them, we process them under Article 9(2)(b) and Article 10 of the GDPR and Law 190/2018, and only the Aravela staff who prepare your contract can open them. Businesses never see them.

Your national identification number (CNP) is processed only to meet legal duties such as contracts, payroll and tax, as Article 4 of Law 190/2018 allows.

Businesses

A business sees nothing about a job seeker. Businesses see your profile only after we approve you and publish it, and they see what they need to judge whether you fit a role: your name, photo, headline, roles, skills, certificates, languages, experience, availability and the rate that applies to them. They never see your identity documents, medical or criminal record documents, bank details, payslips or our internal review notes.

When you work with a business, it also sees what the engagement needs: your contract, timesheets for its venues, and the chats and calls you have with its team.

Service providers (processors)

We use providers who process data only on our instructions and under a data processing agreement (Article 28 GDPR):

• hosting and storage on servers in the European Union;
• Google (Gemini service) for reading CVs and the assistant features described above;
• email delivery and our own mail server;
• an SMS gateway for text messages;
• the push services of your browser or phone maker (for example Google, Apple or Mozilla), which carry push notifications to your device;
• professional advisers such as accountants and lawyers, who are bound by confidentiality.

Authorities

We give data to public authorities (for example the tax authority, the labour inspectorate or a court) when the law requires it.

We do not sell personal data, and we do not share it with anyone for their own advertising.

We keep the platform and its data in the European Union. Some providers, Google in particular, may process data in other countries, including the United States. When they do, the transfer relies on an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework for certified companies) or on the Commission’s Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply.

Job seekers we do not approve:

12 months after our decision, so we can answer questions about it, then deleted, unless you ask us to delete it sooner.

Accounts:

while the account is open, and 12 months after it is closed.

Contracts, timesheets, invoices and accounting records:

10 years from the end of the financial year, as Romanian accounting law (Law 82/1991) requires.

Payroll records:

for the period Romanian law sets for payroll statements (currently 50 years).

Signed agreements and signature evidence:

as long as the agreement can be relied on, plus the limitation period for claims (generally 3 years).

Chat messages and files:

while the conversation exists on the platform; a participant can delete their own messages.

Security logs:

6 months.

When a period ends we delete the data or make it anonymous. Backups are overwritten on a rolling cycle.

Data travels over encrypted connections (HTTPS). Passwords are stored only as one-way hashes. Each person sees only what their role allows: a business sees only published profiles and its own engagements, and documents are open only to the staff who need them. Signed agreements carry a fingerprint of the signed text, so a later change can be detected. Video calls are not recorded.

No system is perfectly secure. If a breach puts your rights at risk, we will tell the supervisory authority within 72 hours and tell you without undue delay, as the GDPR requires.

Under the GDPR and Law 190/2018 you have the right to:

Access:

get a copy of the personal data we hold about you.

Rectification:

correct data that is wrong or incomplete. You can change most of your profile yourself.

Erasure:

ask us to delete your data, except what the law obliges us to keep.

Restriction:

ask us to pause using your data while a question about it is settled.

Portability:

receive the data you gave us in a structured, machine-readable format, or have it sent to someone else.

Objection:

object to processing based on our legitimate interest; we then stop unless we have compelling reasons.

Withdraw consent:

where we rely on your consent, withdraw it at any time; this does not affect what was done before.

To use any right, write to [email protected]. We answer within one month; for a complex request we may take two more months and will tell you why. We may ask you to confirm your identity first.

You can also complain to the Romanian supervisory authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, www.dataprotection.ro, or to the authority of the EU country where you live or work.

We send emails and text messages about your account, your application, interviews, contracts, timesheets, invoices, messages you received and support requests. They are service messages, not advertising.

You choose which notifications you get in your notification settings, and you can turn push notifications off for each device. Messages needed to keep your account secure or to perform a contract (for example a password reset or a contract to sign) cannot be turned off while the account is open. Your mobile operator may charge for data or messages.

We never sell or rent phone numbers or email addresses.

Aravela uses only the cookies and browser storage it needs to work. There are no advertising cookies, no third-party tracking and no analytics cookies, so we do not ask for cookie consent.

auth (cookie, 7 days):

keeps you signed in. Strictly necessary.

av-theme (cookie, 1 year):

remembers whether you chose the light or the dark theme.

smartMatch (cookie, 30 minutes):

keeps a business’s Smart Match search while it moves between pages.

Local storage on your device:

drafts of profile forms you have not saved yet, your recent searches and emoji, and layout choices such as column widths, folded panels and notification sound. This stays in your browser and is never sent to us.

You can delete cookies and local storage in your browser settings. If you delete the auth cookie you will be signed out.

The profiles, CVs and other data of professionals you receive through Aravela are personal data. Once you hold them, your business is a separate controller for its own use of them and must follow the GDPR. You may use them only to assess, engage and manage the professionals we introduce, keep them secure, and delete them when you no longer need them. You must not copy them out of Aravela for any other purpose, pass them to anyone else, or use them to contact a professional outside an engagement arranged through Aravela.

When you invite colleagues, you confirm that they know their work details will be processed as this policy describes.

Aravela is for people aged 18 or over. We do not knowingly accept registrations from anyone younger, and we delete such an account when we find one.

When we change this policy we publish the new version here with a new date. If a change matters to you, we tell you by email or in the app before it applies.