Last updated: 5 September 2026
WHO WE ARE
This Privacy Policy explains how Cybrient Technologies SA (“we”, “us”, “our”), a company incorporated in Switzerland with its registered office at Rue Liotard 6, 1202 Geneva, Switzerland, handles personal data in connection with Who is Hiring and the website at https://whoishiring.ro/ (the “Site”). We are the controller for that processing.
To contact us about anything in this policy, including to exercise your rights, use https://cybrient.com/en/contact-us.
We have not appointed a data protection officer, and we are not required to appoint one. Requests reach the people responsible through the contact form above.
WHICH LAW APPLIES
We are established in Switzerland, so the Swiss Federal Act on Data Protection (FADP) applies to our processing. Where we offer the Site to people in the European Economic Area or monitor their behaviour there, the EU General Data Protection Regulation (GDPR) also applies, and we identify the GDPR legal basis for each purpose below. Where the UK GDPR applies, references to the GDPR should be read accordingly.
PERSONAL DATA WE PROCESS
a) Job listings and company records gathered from other sources
The Site is a job aggregator. We collect job listings and company information from employer websites, applicant tracking systems, public sources and third-party feeds. Most of that is company information rather than personal data, but a listing sometimes names an individual — a hiring manager, a recruiter, a contact person — and a one-person business is itself an identifiable individual. Where that happens we process the name, role, and any business contact details published in the source, together with the listing text and the address of the source page.
b) Account data
If you register, we process your name, email address, password (stored only as a hash), and the settings and activity attached to your account.
c) Company claims
If you claim a company profile, we process the identity and authority evidence you submit, our record of the decision, and any correspondence about it. We keep that record whether the claim is granted or refused, so that we can deal consistently with a later claim over the same company.
d) Paid orders
If you buy a job posting or a boost, we process the billing name, billing address, company details, VAT number where you give one, and the order and invoice record. Card details are entered with, and held by, our payment provider; we do not receive or store full card numbers.
e) Messages you send us
If you use a contact or removal form, we process what you put in it, your email address, and our reply.
f) Technical data
Our servers record the usual access data: IP address, date and time, the page requested, the referring page, browser and operating system, and the status of the request. These logs exist to keep the Site running and secure.
WHY WE PROCESS IT, AND ON WHAT BASIS
To operate and publish the Site, including the aggregated listings and company records. Our legitimate interest in running a job-search service, and the public interest in job listings being findable (GDPR art. 6(1)(f); FADP art. 31). The underlying material has already been published by the source for the purpose of being found.
To provide accounts, claims and paid services. Performance of our contract with you, and steps taken at your request before entering into it (GDPR art. 6(1)(b)).
To verify a company claim and to prevent impersonation and fraud. Our legitimate interest, and the legitimate interest of the company concerned, in claims being genuine (GDPR art. 6(1)(f)).
To answer messages and removal requests. Our legitimate interest in responding, and compliance with our legal obligations where the request is a data protection request (GDPR art. 6(1)(f) and 6(1)(c)).
To keep the Site secure and to investigate abuse. Our legitimate interest in the integrity of the service (GDPR art. 6(1)(f)).
To keep accounting records and meet tax obligations. Compliance with a legal obligation (GDPR art. 6(1)(c); article 958f of the Swiss Code of Obligations).
Any optional analytics or marketing cookie. Your consent, which you may withdraw at any time (GDPR art. 6(1)(a)).
AUTOMATED PROCESSING, AND THE ACCURACY OF WHAT WE PUBLISH
Listings and company records are processed automatically. We normalise locations, match listings to companies, and enrich company records with details such as an address or a logo from third-party services. This is ordinary automated processing.
It also means a record can be wrong: a listing may be attributed to the wrong company, an address may be out of date, or a record may persist after the source has removed it. We take reasonable steps to keep records accurate, but we cannot verify everything we ingest. If something about you or your company is wrong, tell us at https://cybrient.com/en/contact-us and we will correct or remove it.
We do not make decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing. A decision to refuse or revoke a company claim is taken by a person.
COOKIES AND MEASUREMENT
We use cookies that are strictly necessary for the Site to work, such as keeping you signed in and holding your language choice. These do not require consent.
Where we use analytics, it is to understand which pages are used and how the Site performs, never to build a profile of you for advertising. Where consent is required for a cookie, we ask for it and you can withdraw it at any time. You can also block or delete cookies in your browser; parts of the Site may then stop working.
WHO ELSE SEES THE DATA
We do not sell personal data. We share it only with:
our hosting and infrastructure providers, who store and serve the Site on our instructions;
our payment provider, for paid orders;
service providers we use to enrich company records, including Amazon Location Service for address details;
content delivery networks and third-party services whose assets the Site loads in your browser — including our logo provider and the providers of icon, script and font libraries. Because your browser fetches those files directly, those providers receive your IP address and basic request data. We do not control what they then do with it, and their own privacy notices apply;
professional advisers, and public authorities or courts where the law requires it or where we need to establish, exercise or defend legal claims.
DATA OUTSIDE SWITZERLAND AND THE EEA
Some of the providers above operate outside Switzerland and the European Economic Area. Where we transfer personal data to a country that does not offer an adequate level of protection, we rely on appropriate safeguards, in practice the European Commission's standard contractual clauses together with the Swiss addendum recognised by the Federal Data Protection and Information Commissioner. You can ask us for details of the safeguards used for a particular transfer.
HOW LONG WE KEEP IT
Listings and company records: for as long as they are useful to a job search, and removed on a legitimate request or when the source withdraws them.
Account data: for as long as the account exists, then deleted or anonymised.
Company claim records: up to three years after the decision, so that later claims over the same company can be handled consistently.
Invoices and accounting records: ten years, as article 958f of the Swiss Code of Obligations requires.
Contact messages: up to two years after the matter is closed.
Server logs: normally up to twelve months, longer only where a specific security incident is being investigated.
YOUR RIGHTS
Subject to the conditions and exceptions in the FADP and, where it applies, the GDPR, you have the right to:
ask whether we process personal data about you, and obtain a copy of it;
have inaccurate data corrected and incomplete data completed;
have data erased;
have our processing restricted;
receive data you gave us in a structured, commonly used, machine-readable form, and have it sent to another controller where that is technically feasible;
object at any time to processing based on our legitimate interests, including the publication of a record concerning you, on grounds relating to your particular situation;
withdraw any consent you have given, without affecting processing already carried out on it.
Exercising these rights is free, and we answer within thirty days, or tell you why we need longer. Make a request at https://cybrient.com/en/contact-us. We may ask you to confirm your identity, or your authority to act for a company, before we act — not to obstruct the request, but so that we do not disclose or delete someone else's data on the strength of an unverified message.
COMPLAINTS
If you are not satisfied with how we have handled your data, please raise it with us first. You may also complain to a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, CH-3003 Bern (www.edoeb.admin.ch); in the European Economic Area or the United Kingdom, the authority for your country of residence, place of work, or the place of the alleged infringement.
SECURITY
We take appropriate technical and organisational measures to protect personal data, including encryption in transit, encryption at rest for sensitive fields, access control, and logging. No internet service is completely secure, and we cannot guarantee that no incident will ever occur; where the law requires it, we notify the competent authority and affected individuals.
CHILDREN
The Site is not directed at children and we do not knowingly collect their personal data. If you believe a child has given us personal data, tell us at https://cybrient.com/en/contact-us and we will delete it.
CHANGES TO THIS POLICY
We may update this policy. We will change the “Last updated” date above, and where a change materially affects you we will draw attention to it on the Site. The version published here is the one that applies.
CONTACT
Questions about this policy, or about how we handle personal data, go to https://cybrient.com/en/contact-us.
