Privacy Policy hr.makeupshop.ro

Last updated: March 19, 2026

This Privacy Policy explains how we process personal data through the HR.makeupshop.ro recruitment platform and in connection with recruitment processes carried out by Makeup Shop. This Policy applies to individuals who create an account, apply for jobs, complete forms, take tests or assessments, attend interviews, or otherwise communicate with us through this platform.

1. Data controller

The data controller is S.C. MAKEUP SHOP S.R.L., with its registered office at Strada Mihail Kogălniceanu nr. 2, Sat Miroslava, Comuna Miroslava, Iași County, Romania, postal code 707305, registered with the Trade Register under no. J22/886/2010, tax identification code RO27079589, referred to in this Policy as “Makeup Shop”, “we”, “us” or the “controller”.

For privacy-related questions or to exercise your rights, you may contact us at gdpr@makeupshop.ro, by phone at +40 756 800 300, or by post at the address above.

2. What types of data we may process

Depending on the role you apply for, how you use the platform, and which evaluation steps are enabled for that role, we may process the following categories of personal data:

identification and contact data, such as first name, last name, email address, phone number, city, address, and similar details;
professional data, such as your CV, work history, education, certifications, portfolio, skills, languages, and other information relevant to your application;
candidate profile and application data, such as the jobs you applied for, uploaded documents, availability, submitted answers, application status, and platform interaction history;
assessment data, such as test answers, scores, results, reviewer observations, feedback, summaries, or other outputs generated during the evaluation process;
interview-related data, including scheduling details, notes, internal feedback and, where a specific recruitment step uses this functionality, audio/video recordings and transcripts;
technical and usage data, such as IP address, browser, device type, session identifiers, security logs, actions performed in the platform, and access timestamps;
optional data that you choose to provide or that is explicitly requested by an application form, such as a profile photo, date of birth, gender/sex, or similar information, where there is a legitimate purpose and lawful basis for doing so.

Please do not upload sensitive data that is not necessary for recruitment, such as health information, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, or information concerning sex life or sexual orientation, unless we expressly request it and there is a clear legal basis for doing so.

3. Purposes of processing and legal bases

We may process your personal data for the following purposes:

creating and managing your candidate account, authentication, and operation of the platform;
managing your application and running the recruitment process;
scheduling interviews, sending administrative communications, and managing our relationship with you in connection with the role you applied for;
running tests, assessments, interviews, and generating related results;
assessing the suitability of your application for the relevant role and documenting the recruitment process;
platform security, fraud prevention, prevention of unauthorised access, troubleshooting, audit, and service continuity;
complying with applicable legal obligations and handling complaints, requests, or disputes;
retaining your data for future opportunities or talent pool purposes, where we have an appropriate legal basis, including your consent where required.

The legal bases we may rely on include, as applicable:

taking steps at your request prior to entering into a contract and, where relevant, performance of a contract;
compliance with a legal obligation;
our legitimate interests in managing recruitment, assessing candidates, protecting the platform, and defending our rights, after assessing the balance between our interests and your rights;
your consent, where this basis is required or chosen by us for a specific processing activity.

If certain data is necessary in order to process your application and you choose not to provide it, we may be unable to continue the recruitment process or provide certain platform features.

4. Sources of data

We primarily collect data directly from you. In some situations, we may also receive data from other sources, such as internal recruiters, professional referrals, recruitment partners, or other relevant sources permitted by law. If we receive your data from a source other than you, we will provide the information required by law where applicable.

5. Who we may share data with

Your personal data may be accessed or disclosed, where necessary, to:

members of our team involved in recruitment, HR, management, or technical administration of the platform;
service providers that help us operate the platform and related processes, such as hosting, email, security, IT maintenance, video/interview, assessment, or technical support providers;
consultants, auditors, lawyers, or other professionals where necessary to protect our legitimate interests or for compliance purposes;
public authorities, institutions, courts, or other competent bodies where we have a legal obligation or a legitimate request to do so.

We do not sell your personal data.

6. International transfers

Where possible, we aim to use providers and infrastructure located within the European Economic Area. If, in some cases, personal data is transferred outside the European Economic Area, we will use a transfer mechanism recognised by applicable law, such as an adequacy decision or standard contractual clauses, together with appropriate supplementary measures where necessary.

7. How long we keep data

We keep personal data only for as long as necessary for the purposes for which it was collected or in order to comply with legal obligations and our legitimate interests.

Candidate account data is kept for as long as the account exists and for a reasonable period afterwards where necessary for backup, security, audit, and follow-up request handling.
Application and assessment data is kept during the recruitment process and for a reasonable period after its completion for handling requests, complaints, internal audit, defence of rights, and process improvement.
Data retained on the basis of consent for future opportunities is kept until consent is withdrawn or until the relevant period communicated for that purpose expires.
Technical logs and security data are kept for as long as necessary for security, technical investigations, and service continuity.

If you are hired, certain recruitment data may be carried over into internal employment-related processes and retained in line with applicable legal obligations and policies governing the employment relationship.

8. Automated decision-making

The platform may generate scores, summaries, rankings, or AI-assisted feedback. However, final recruitment decisions are not made solely by automated means producing legal effects or similarly significant effects on you without human involvement, unless we expressly inform you otherwise and there is a lawful basis for doing so.

9. Data security

We implement reasonable technical and organisational measures to protect personal data against unauthorised access, misuse, loss, destruction, or unlawful disclosure. That said, no IT system offers absolute guarantees, and using any online platform comes with some inherent level of risk.

10. Your rights

Subject to the conditions provided by law, you have the following rights:

the right to be informed;
the right of access;
the right to rectification;
the right to erasure;
the right to restriction of processing;
the right to data portability, where applicable;
the right to object;
the right not to be subject to a decision based solely on automated processing, including profiling, subject to legal conditions;
the right to withdraw consent at any time where processing is based on consent.

To exercise these rights, you may contact us at gdpr@makeupshop.ro. We may request reasonable information to verify your identity. We will respond without undue delay and normally within one month of receiving your request, with the possibility of extension in complex cases as permitted by law.

11. Cookies and similar technologies

The platform may use cookies and similar technologies that are necessary for authentication, session continuity, security, technical preferences, and proper service operation. If analytics tools or other non-essential technologies are used, they will be handled separately through the relevant consent mechanism and/or cookie policy.

12. Complaints

If you have concerns or believe your data has been processed incorrectly, we encourage you to contact us first so we can try to resolve the issue directly.

You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), Bd. G-ral Gheorghe Magheru nr. 28-30, District 1, 010336, Bucharest, Romania, email: anspdcp@dataprotection.ro / dpo@dataprotection.ro, phone: +40 318 059 211, or with another competent supervisory authority, where applicable.

13. Changes to this Policy

We may update this Privacy Policy from time to time. The version published on the platform is the version that applies from the date shown at the top of the page.