Source: https://www.stepstone.nl/m/?event=content.terms
Timestamp: 2019-04-19 01:13:29+00:00

Document:
StepStone NV/SA (hereinafter referred to as "StepStone") and the undersigned business partner (hereinafter referred to as "Customer") agree to fulfil the performance of their contract pursuant to these Terms and Conditions and the price list. StepStone's Terms and Conditions together with the price list contain the whole agreement between StepStone and the Customer. Any terms and conditions of the Customer do not apply, unless StepStone explicitly consents to them in writing.
The contract is concluded when StepStone receives the signed acceptance of the contract offer, which shall contain the date and signature of the Customer. Amendments and additions to the contract as well as statements and individual instructions must be made in writing. Faxes are considered to be a written form. Electronic form, including email is excluded.
The contract obliges StepStone to publish the products and perform the services agreed upon in the contract, displayed at www.stepstone.be ("Service Elements") in accordance with these Terms and Conditions. The publishing period in relation to access to application service provider products shall be at least 20 hrs per day. The description of services in our Additional Terms and Conditions applies in addition.
The contract entitles StepStone to use Customer data for trend analysis and surveys, however, results shall be published anonymously.
Payment for the services performed by StepStone is set out in the price list given to the Customer. The price list which was in force and given to the Customer at the time when the offer was made to the Customer shall be valid. Services that are not included in the StepStone price list are subject to individual agreements between StepStone and the Customer.
Payment referred to in section 4, includes all additional costs such as e-mails, telephone calls, fax, data transmission, copies and postage which are usually incurred. The cost of corrections and proof-reading that have occurred as a result of the Customer supplying incorrect data are not included. StepStone will inform the Customer if the additional costs exceed the average amount in relation to individual orders. The Customer is obliged to pay StepStone for these additional costs if he has consented to them.
If a Service Element is published containing an error, the first correction of the incorrect Service Element is free of charge provided that the error was not caused by the Customer's faulty performance. Thereafter every additional correction shall be charged for according to StepStone's price list valid at the time when the order for correction was made. However if StepStone makes a mistake in the first correction, the first additional correction shall be free of charge.
The Customer will be invoiced immediately after the first rendering of a Service Element and at the latest 14 days after the conclusion of the contract if no Service Element has been rendered due to the fault of the Customer. Payment is due 10 days after receipt of the invoice, without deductions. When a default in payment or a deferment of payment has occurred interest will be charged at the rate of 8% above the base rate of the European Central Bank and collection costs will also be charged. In case of default in payment, the debtor has to pay a compensation for the extra judicial cost, and without the need of a notice of default, an amount of 10% payable on the invoice due, with a minimum of 200 euro the invoice, unless the actual collection costs, including costs for legal assistance, would be higher.In the event of a default in payment, StepStone can suspend further performance of the contract until the payment has been made in full. This shall not apply if the Customer is entitled to assert a right of retention. If the parties agreed on payment by instalments, and an instalment is not paid 30 days after the due date, the whole of the remaining amount shall become payable immediately.
If payment is made from abroad, cheques for less than 1,000 Euros will only be accepted if an administration charge of 25 Euros is paid in addition. Payment by bank transfer from abroad will only be accepted if all bank fees and expenses are paid by the Customer.
StepStone is committed to continually optimise the number of responses to Advertisements of the Customer and to improve the quality and quantity of the searchable applications. This includes working together with several co-operation partners in offline or online media. The Customer hereby gives StepStone the right to publish Service Elements without prior notice in online and offline media, print media and audio and video media. StepStone pays special attention to the image and quality of its co-operation partners.
The Customer's rights under this contract are neither transferable nor assignable. The contract can only be transferred to a third party with StepStone's consent.
After concluding this contract the Customer agrees to receive by e-mail or post questionnaires, newsletters and other commercial communications that help StepStone to improve and maintain its quality standard. The Customer can withdraw his consent at any time without formal requirements and the withdrawal of consent will be immediately effective.
StepStone reserves the right to not execute orders placed by the Customer or to withdraw Service Elements that have already been published if they breach legal provisions, official regulations, the rights of third parties or good morals ("Illegal Content"). This also applies if links included in the Customer's Service Elements lead directly or indirectly to pages containing Illegal Content. The Customer's payment obligation remains unaffected. StepStone shall only be obliged to remove Illegal Content that breaches legal provisions and/or at the request of the Customer. The Customer undertakes to indemnify StepStone and hold Stepstone harmless against all payments and legal costs incurred due to Illegal Content or breach of law on first demand.
· If a self employed or freelance job is posted it must be made explicitly that the job is self employed or freelance.
· If the candidate has to make payments or investments (including training and/or travel fees) this must be made explicitly clear in the Service Element. The same applies where a commission is paid for the attraction of new members to a closed system.
· Service Elements must refer to a specific vacant position or job.
· Ads for club memberships and ponzi schemes, pyramid sales or similar are not allowed.
· Even if the aforesaid requirements are met no content must be published besides the content related to the position or job that is irrelevant to the job search, such as e.g. competitions, events without career relevance, mere sales campaigns etc.
· Direct links to external job offers that are not published by StepStone are not permitted.
If these requirements are not fulfilled the content shall be deemed Illegal Content as per 6.4.
StepStone bears no responsibility for received data, texts for Advertisements or the corresponding storage media, and in particular is not obliged to preserve or return these items to the Customer.
StepStone is entitled to use vicarious agents.
The Customer is responsible for configuring and arranging his infrastructure in accordance with the prevailing state of the art so that it becomes neither a target nor a source of disruptions which could affect the Internet service supplied by StepStone or trouble and fault free network operation in general.
The Customer guarantees that all of his content or parts thereof published by him on the Internet or given to StepStone for publication are not encumbered by third party rights. The Customer shall indemnify StepStone and hold Stepstone harmless against any damage StepStone suffers from an infringement of this provision by the Customer on first demand.
This contract does not transfer any (intellectual) property right, licence or right of use from Stepstone to the Customer. All of Stepstone's rights (including but not limited to copyright, trademark rights, sui generis database rights, logos, titles as well as any other commercial rights) remain StepStone's (intellectual) property without restriction.
All material and content published by StepStone are subject to StepStone's intellectual property rights (copyright, trademark rights and sui generis database rights), except for the individual elements of such material and content designed by the Customer or a third party that are already subject to a Customer's or third party's intellectual property rights and that have not been modified/revised by Stepstone.
By placing the order for publishing job listings on the Internet, the Customer acknowledges that StepStone is the producer of the database of such job listings and has the sole database right to the Customer's job listings published in the database by StepStone.
The Customer grants Stepstone a license to use, reproduce and communicate to third parties the customer data/content/logo/trademark/(trade)name or other signs for purposes of rendering the Service Elements. By placing the order, the Customer warrants that he has purchased or otherwise acquired all necessary user rights, copyrights and ancillary copyrights that are required for Stepstone to render the Service Elements (including but not limited to the publication of Customer's data and content on the Internet).
StepStone shall use its best efforts to supply the Service Elements as described in the relevant documentation. If the Service Elements involve the design of software, StepStone will use its best efforts to design software free of errors. The Customer acknowledges that, according to current technical standards, it is not possible or economically reasonable to design a completely error-free program.
The Customer undertakes to provide all information and other documentation required for achieving the objectives set out in the contract. This includes, in particular, the delivery of Advertisement texts and layouts in a digital form. This also includes the Customer's obligation to immediately inform StepStone if one of the Service Elements becomes outdated. Furthermore, the Customer is obliged to fulfil the requirement to co-operate as described in the corresponding Additional Terms and Conditions or, when available, as described in the product descriptions for the various Service Elements. If these requirements are not fulfilled in time, StepStone's period of performance shall be prolonged accordingly. This does not apply if StepStone is responsible for the delay in performance.
If damages are due for any other reason, they shall not exceed 5% of the total contract price.
The correctness of the data published by StepStone at the request of the Customer or Applicant. StepStone shall not be liable for statements given in this data.
The performance of third parties, which the Customer has contracted in order to fulfil the obligations of these Terms and Conditions.
For any Force Majeure event such as those set out in section 10.1 below.
For a minimum number or minimum quality of applications from Candidates to the Customer's Job Listings.
For investments made by the Customer in relation to the contract and in anticipation of a minimum number of applications.
If the contractually guaranteed usage of a Service Element is limited by protection rights of third parties, StepStone may, at its own expense, either change such Service Element to avoid such limitation or obtain the necessary permission to use such Service Element in compliance with third party rights. These measures should not result in the functionality of the Service Element being unreasonably limited for the Customer. If the Customer becomes aware of protection rights of third parties, the Customer is obliged to immediately inform StepStone hereof in writing.
The Customer must make all claims for compensation within one year from the date on which the Customer noticed, or should have noticed, the failure.
The limitations on and exclusions of liability for damages under section 9 apply regardless of whether the liability is based on breach of contract, tort (including negligence), strict or product liability, hidden defects, breach of warranty, or any other legal duty, and even if (i) Stepstone is advised of the possibility of such damages or if such possibility was reasonably foreseeable and (ii) the damages result from Stepstone's serious fault.
In the event of unforeseeable incidents that have a substantial effect on the economics of a contract, or in the event of force majeure (both events referred to as "Force Majeure"), the contract will either be adapted accordingly and in good faith (eg. the periods of performance are prolonged for the duration of the Force Majeure), or terminated by Stepstone with immediate effect.Force Majeure includes but is not limited to: wars, fire, terrorist attacks, server breakdowns that are beyond StepStone's control or caused by an insufficient communication infrastructure or the deficient software or hardware of a Customer, cuts in telecommunication networks etc.
StepStone shall treat as confidential all information delivered pursuant to this contract which is marked confidential. This obligation of StepStone shall also continue after the this contract has expired.
The Customer is advised in accordance with data protection laws that StepStone stores his data in a machine readable form and uses it according to the purposes of this contract.
It is the Customer's responsibility to treat any ID, password or username or other security device provided for the use of the services with due diligence and due care and to take all necessary steps to ensure that they are kept confidential, secure, are used properly and are not disclosed to unauthorized persons. The Customer will be held responsible for any usage of his password or his username by third parties unless the Customer provides evidence that the access to such password or username by such third parties has not been enabled by him and that the cause of any such access attained does not lie within his sphere of influence. The Customer must immediately inform StepStone if it is likely or has become known that someone not authorised is using his password or username or if they are being or are likely to be used in any unauthorized way. In the event of a breach of any material obligations of the Customer under this contract, in particular including but not limited to the infringement of any obligation described in this section, StepStone is entitled to immediately interrupt the operation of its services without further notice and without releasing the Customer from any payment obligations.
This agreement shall be effective from the date on which StepStone receives a signed version of the contract. The term agreed therein shall begin with the rendering of the first Service Element. If the Customer is responsible for the late rendering of the first Service Element the contract shall, at the latest, begin 14 days after the date StepStone receives the signed contract. This contract terminates automatically after the agreed period has expired, unless the Additional Terms and Conditions set out below contain different provisions.
Service Elements can only be ordered during the agreed contractual period. The Client's right to order Service Elements that have not been claimed before the termination of the contract shall end with the termination of the contractual period.
The laws of Belgium shall exclusively apply to this contract. The courts of Brussels shall have exclusive jurisdiction for disputes arising out of this contract.
Place of performance for all legal relationships between StepStone and the Customer shall be Brussels.
These Additional Terms and Conditions for job listings, banners and company presentations ("Advertisements") apply in addition to our General Terms and Conditions and prevail in case of doubt.
StepStone shall publish Advertisements on the Internet on behalf of the Customer in accordance with section 3 of the General Terms and Conditions.
- Within a job ad only links to the company's online presence are allowed.
- Links to competitors of StepStone are not allowed unless the customer itself is competitor of StepStone and links to its own online presence.
- All content of a job ad must be directly visible to the user. The Customer's own tracking codes are not permitted unless they do not process personal data. Links to external sites must open in a separate window and must be designed in such way that it is perceivable that they link to external pages.
- Links are permitted only as "no follow" links, i.e. they must be set in such way they are not used by search engines to evaluate the link popularity.
In addition, StepStone is entitled, but not obliged, to publish Advertisements in other media, offline or online or by print or to distribute Advertisements to third parties for further publishing. StepStone co-operates with media partners for this purpose, and hosts the StepStone Job board or parts thereof at further URLs without requesting prior approval from the Customer. A list of co-operating media partners can be requested from Stepstone. StepStone will not charge any additional fees for such additional performance.
The advertisement must advertise a specific job and function and must not advertise anything else; in particular the advertisement must not mention any recruitment events of the customer unless it is part of the selection process for the job specifically advertised in the job advertisement."
Upon customers request StepStone will publish a button in relation to the job advertisements that is labeled with "Apply Now" or similar. Depending on the customer's selection, this button can either link to a page designated by the customer or to a standardized application form operated by StepStone on its platforms, with which the applicants can provide the data requested through the form and have them transmitted by StepStone to the customer. The customer can receive the application at his choice in the StepStone Recruiter Space. StepStone will then submit the application to the specific account of the customer in the applicant management functionality in the StepStone Recruiter Space.
Unless otherwise agreed, a job listing is displayed for a period of 30 days, a banner for a period of 7 days.
StepStone offers to publish Box Number Advertisements. Incoming electronic applications will be forwarded without adaptation or viewing the content to an e-mail address of the Customer. StepStone is not responsible for the content of such forwarded applications. Only electronic applications will be considered for forwarding, offline applications will not be forwarded. Also, applications with a clear lock flag will not be forwarded. StepStone is not liable for the content of the applications. StepStone reserves the right to delete applications with obvious Illegal Content (as described in section 6.4 of the General Terms and Conditions).The Customer is obliged to treat Box Number Advertisements in accordance with local laws and data protection regulations. The Customer indemnifies StepStone on first demand against all claims of third parties arising from the Customer's failure to comply with legal or data protection provisions.
The Customer is advised and agrees that StepStone cannot prevent the unapproved publication of job listings by third parties. StepStone shall however, subject to technical and legal limitations, use its best efforts to prevent such unapproved publication.
The Customer shall hereby assign to StepStone any rights in the ownership of a database that may exist with respect to any multiple Advertisements delivered to StepStone for publication. In particular, the Customer acknowledges that StepStone is the producer of the database of such job listings and has the sole database right to the Customer's job listings published in the database by StepStone.
An offer from StepStone for a price lower than the price mentioned in the price list is only valid in relation to the specific Customer and under the specific conditions such an offer was made by StepStone. It is not valid for a Customer who wants a third party, for example, an agency to act on his behalf.
The transfer of an Advertisement Agreement ("Reselling") to a third party requires StepStone's prior consent.
These Additional Terms and Conditions CV Database apply in addition to our General Terms and Conditions and prevail in case of doubt. StepStone operates databases on the internet which contain CVs of jobseekers ("Candidate"). Candidates can enter their CVs into the databases. By activating the CV the Candidate publishes the CV either in anomyised form, i.e. without making personal data publicly accessible ("anonymised CV"), or in such a way that that his personal data are directly accessible in the database ("public CV"). The Customer, that orders an access to the CV database, may directly view public CVs and contact the candidates behind the CV and in case of anonymous CVs may, via the StepStone electronical system, send a contact request to the candidate behind the CV.
Furthermore, as an additional cost-free service, the customer can save comments about candidates whose profiles he can view anonymously or publicly. These comments are saved and processed by StepStone on behalf of the customer in the sense of Art. 28 GDPR; the Additional terms and conditions StepStone Data Processor Agreement apply here. For the sake of clarity, it is specified that the other services provided by the DirectSearch Database are not processed as data processor on behalf of the customer. StepStone merely provides the content stored by the candidate at StepStone's platforms and remains responsible for data protection as controller. As far as the customer uses this data, he may become a separate and independent controller.
StepStone only grants access to the CV Database to Customers for their own personal needs. No Customer may forward access to the CV Database or anonymous CVs to third parties. It is not allowed to access the CV database for enticement of customers. No Customer may place deep links from his own web site to the CV Database ("Deep Links"). StepStone reserves the right to take immediate legal action against any infringement of this clause without giving any prior warning notice.
The Customer may make use of certain functionalities in the "CV-Center". The service does not include any data backup for the Customer. Data may be removed or deleted from the back-office at any time without giving prior warning. Data will automatically be removed from the CV-Center for data protection reasons as soon as a Candidate deletes his CV from the CV Database. The CV database must not be used for any purposes violating antidiscrimination law.
If the Customer saves the personal data of Candidates on his own systems he is obliged to comply with further monitoring duties. Should a Candidate delete his CV from the StepStone Database and the CV Center, the Customer is obliged to immediately delete such data from his own systems. He is then also obliged to destroy any related hard copies.
The Customer is entitled to contact up to 500 CVs from the CV Database per month through the CV Database.1.6In case on anonymised CVs Candidates may block certain companies from accessing their CV. In such cases the respective Customer can not send a contact request to the Candidate.
The Customer warrants that he will comply with all legal provisions, third party rights and good morals. Section 6(4) of the General Terms and Conditions shall prevail.
In particular, the Customer warrants not to forward or otherwise communicate the personal data of Candidates, to respect their confidentiality and to comply with all applicable data protection and privacy rules. The Customer is advised that, if a Candidate should approach StepStone requesting the deletion of any data relating to the Candidate, and StepStone thereafter gives notice to the Customer of this request, the Customer is obliged to delete any hard copy or electronic files or data relating to a certain Candidate Profile immediately.
The Customer undertakes to indemnify StepStone against all losses, costs, claims, damages or other expenses that are caused by the Customer, unless StepStone is responsible.
Candidates are responsible for completing their Candidate Profiles. Therefore, StepStone does not warrant their completeness, correctness, accuracy or accessibility. StepStone does not warrant any degree of response.
The data of jobseekers registering on the StepStone sites ("Candidates") is strictly confidential and may only be stored, or used according to applicable data protection laws. The Customer is only entitled to contact Candidates for filling certain vacancies. StepStone is entitled to block the account of the Customer and withhold access to Candidate data in cases of infringements by the Customer.
The Customer is advised that special terms apply to data transfers outside the European Union. Generally, such data transfers require the consent of the Candidate - even if the transfer occurs within a corporate group.
Depending on the specific price model agreed upoon the Customer can access a predefined number of CVs in the CV Database for one month or pays per accessed CV or per number of searches he ran and may contact up to 500 CV profiles individually in order to fill a specific open position, in case of public CVs directly and in case of anonymous CVs after prior contact request. The number of contacts is limited to 500. Massmails and spam mails are not permitted.
By ordering the Job Feed Services, StepStone is obliged to automatically mirror the job listings on the Customer's web site on the StepStone web site during the contractual period. The mirroring process is fully automated. Every Advertisement of the Customer will be published in an identical form. Additional manual changes are not provided. This description of services shall be deemed as an agreement of functionality and is comprehensive.No other functionalities are granted.
Job Feed is a complex software solution. A good co-operation between the parties ensures its successful implementation and the expected functionality. The current Job Feed product description and the Job Feed technical documentation contain obligations of the Customer and conditions precedent for a successful usage of the program. The Customer is obliged to read this documentation before the Job Feed Services start. The Customer is advised that its content will be considered as known.
The term shall be agreed individually. Contrary to the General Terms and Conditions, StepStone shall delete published job listings after these are deleted from the Customer's database, and StepStone shall publish job listings after they were entered into the Customer's database.
The Job Feed data mirroring will take place at least once per week.
Any Job Feed listing published on the StepStone site in the described form and any additional job listing published after or during the initial publishing period of four weeks shall be considered as booked by the Customer. A job listing shall be considered as accepted if it has been published for seven days on the StepStone site without the Customer rejecting its publication.
StepStone shall count the job listings that were booked and accepted during the contract period and shall provide the Customer with a performance confirmation if requested.
These Additional Terms and Conditions Company Pop-Up apply in addition to our General Terms and Conditions and prevail in case of doubt.
StepStone shall publish a presentation of the Customer's company as a pop-up on the Internet ("Company Pop-Up") on behalf of the Customer.
The Company Pop-Up shall be published during the second and third times a user uses the site per week. It contains a link to the Client's Advertisements published by StepStone. The size must not exceed 200 x 263 pixels.
This description of services is considered to be an agreement of functionality and is comprehensive. Further functionalities are not granted.
Company Pop-Ups will be published for a period of 7 days unless other periods have been agreed by the Parties.
Only one Company Pop-Up will be published on the StepStone site per week. The Customer is not entitled to claim a specific publishing date. Of course, StepStone will try to consider the Customer's requirements as far as possible. The Customer shall usually receive a notice of the publishing date within 3 days, but at the latest one week after receipt of the order.
StepStone is entitled to change the position of the Company Pop-Up on the site or the design of the frame. StepStone is also entitled to adjust the Company Pop-Up to comply with local legal provisions.
These Additional Terms and Conditions StepStone Boost apply in addition to our General Terms and Conditions and prevail in case of doubt.
StepStone shall, on behalf of the Customer, publish a standard graphical banner ("Boost") on the Internet, which is linked to the Customer's job listing published on the StepStone Site. This is to increase traffic.
Boost can only be linked to one job listing. As soon as the job listing is offline, Boost is terminated.
The position of the Boost banner shall be decided by StepStone. Therefore the Customer has no right to have the banner positioned in a specified place.
The ad-server of the online provider shall be authoritative for the purposes of calculating click-rates.
No Agency Commission is granted for StepStone Boost.
The standard graphical banner must not exceed 468 x 60 / 12 KB in size. The StepStone logo will be implemented on the right side of the banner.
Boost shall be published for a maximum of 30 days. Boost will be switched offline after 500 clicks even if the maximum of 30 days has not been achieved.
For such Video Ads that have been produced by StepStone, Customer agrees that StepStone owns the rights of use unrestricted by time or place in the Video Ads for all exploitation methods including but not limited to the right of reproduction, distribution, broadcasting and the making available right. StepStone may grant licenses.
After StepStone's prior approval, Customer may use the Video Ads for its own purposes on its website or on websites of cooperation partners. StepStone will not unreasonably withhold approval. StepStone may make the approval subject to additional payment, unless the Video Ad was produced by Customer. The Customer must not publish the Video Ad on other job boards.
If Customer has produced the Video Ad he shall not be entitled to publish the Video Ad without StepStone's prior approval, unless otherwise is agreed. StepStone may also use the Video Ad on websites of its cooperation partners worldwide.
These Additional Terms StepStone Recruiter Space apply in addition to our General Terms and Conditions and prevail in case of doubt.
The term set out in section 12.1 of the General Terms and Conditions applies. StepStone grants the Customer the non-exclusive, non-transferable right to use the StepStone Recruiter Space during the contractual period. StepStone shall provide the Customer with the job listing tool StepStone Recruiter Space for 20 hours a day at http://www.stepstone.fr/corporate/index.cfm. The Recruiter Space enables the Customer to edit and publish Advertisements on his own. This description of services is considered to be an agreement of functionality and is comprehensive. No other functionalities are granted.
StepStone provides the Customer with a user ID and a password for accessing the server. The Customer may change his password at any time. Within the scope of his general responsibilities, the Customer must ensure that his user ID and password can only be used by persons who are authorised to access the StepStone Recruiter Space. The Customer is also obliged to consider any additional security criteria he has been informed about. If an agency acts on behalf of a Customer, the same provisions apply. StepStone will grant agencies access rights to the listings of their Customers so that they have the possibility of administering listings and of placing new listings on behalf of their Customers. For this purpose the agencies will be provided with access to statistics, current contractual data and old listings placed on behalf of the Customer. To do so, the agency must obtain the prior approval of its Customer and produce this to StepStone, if required by the latter. The agency shall be liable if a Customer makes a claim against StepStone because of a potentially unauthorised dissemination of access rights and information.
also take notes on the respective candidate and, depending on the functionality, set a status of the application and communicate with the applicant.
In connection with the application, the client can also access the applicant's MyStepStone profile via the applicant administration. However, this accessibility to the MyStepStone profile exists only as long as it is active, i.e. if the applicant changes his settings or deletes his profile, access to the profile is no longer possible. The application data submitted by the applicant remain unaffected.
These Additional Terms and Conditions Online Ordering apply in addition to our General Terms and Conditions and our Additional Terms and Conditions Advertisements, and prevail both in case of doubt.
StepStone publishes Advertisements on the internet on behalf of the Customer in accordance with section 2.1 of the Additional Terms and Conditions Advertisements.
Contrary to StepStone's General Terms and Conditions the mandatory written form shall not apply. Declarations of intent can be executed by both parties without any formal requirement and they shall be valid.
Generally, the Customer can choose to pay by direct debit or within 10 days of receipt of an invoice. In all other cases the provisions of sections 4 and 5 of the General Terms and Conditions shall apply.
· The Customer clicks on "placing order"
The contract is concluded when the Customer receives StepStone's order confirmation.Thereafter the Advertisement will be published online.
1.1 In the context of the comment functionality according to para. 1.3 of the Additional terms and conditions CV database and the applicant management functionality according to Sec. 1.3 of the Additional terms and conditions StepStone Recruiter-Space StepStone processes personal data as a processor in the manner described in each case for the purpose described therein on behalf of the customer in accordance with Art. 28 GDPR, observing the following provisions.
1.2 StepStone processes the personal data solely within the framework of the contract and in accordance with the documented instructions of the customer unless there is an exceptional case within the meaning of Article 28 (3) (a) GDPR.
1.3 The processing takes place exclusively in member states of the European union or in another contracting state of the agreement over the European economic area, as far as no other instruction was given and a transmission in accordance with the regulations of Artt. 44 to 49 GDPR is allowed. Already upon conclusion of the contract, in the context of the measures to be taken under section 4.3 StepStone is instructed to transfer personal data to the other subcontractor Akamai Technologies, Inc., 150 Broadway, Cambridge, 02142 MA, USA, as described in Section 6 below. The transfer is permissible under Art. 45 GDPR as Akamai Technologies, Inc is Privacy Shield certified and thus an adequate level of protection exists according to the Implementing Decision of the Commission (EU) 2016/1250 (http://eur-lex.europa.eu/legal-content/EN / TXT / HTML /? Uri = CELEX: 32016D1250 & from = DE). The certification can be viewed at https://www.privacyshield.gov/participant?id=a2zt0000000Gn4RAAS&status=Active.
1.4 The duration of the processing corresponds with the duration of the use of the Recruiter Space, whereby, at the end of the term of contract about the publication of job adverts or the Direct Search Database, the respective access is disabled, upon conclusion of a new contract, the access is reactivated, unless the contract for the use of the Recruiter Space was terminated in the meantime.
1.5 Data subjects in the context of the applicant management functionality are persons who have applied for a job vacancy with the Customer through the StepStone application form. Data subjects in the context of the Direct Search Database are natural persons who have a profile with StepStone.
1.6 The type of personal data used in the context of the processing for the applicant management functionality consists of CV data, such as contact details, educational records, work experience and knowledge and interests, and any other data submitted by the candidate, and data entered by the customer such as comments created by the customer or an application status created by the customer..
In the context of Direct Search, the types of personal data are the comments made by the customer about the persons concerned in connection with the filling of vacancies.
1.7 The subject matter and purpose of the processing is, in the context of applicant management functionality, that the application data submitted by applicants can be made available and viewed in the StepStone Recruiter Space to the customer after his login in the Recruiter Space. If the customer creates a comment or status of the application (depending on the function) in order to manage it, it will also be saved there. If a status of the application can be created, the customer instructs StepStone when entering a status to inform the applicant immediately about this status.
Subject matter and purpose of the processing in the context of the Direct Search is, that the customer can save comments about candidates whose profiles the customer can access through the Direct Search.
1.8 References in these Additional Terms and Conditions StepStone Data Processor Agreement to the General Data Protection Regulation (GDPR) shall be interpreted as references to the corresponding provision in the national data protection legislation until 24.05.2018. Unless there is a corresponding provision in the national legislation, the said obligation shall not apply until 24.05.2018 and will only apply with effect from 25.05.2018.
2.1 In accordance with Art. 4 No. 7 GDPR, the customer is controller of the data processed by StepStone in accordance with the contract.
2.2 The customer informs StepStone immediately and completely if it finds errors or irregularities regarding data protection regulations when checking the outcome of the processing.
2.3 The customer keeps a register for processing activities in accordance with Art. 30 para. 1 GDPR.
3.1 StepStone informs the customer immediately if StepStone believes that an instruction violates applicable laws. StepStone may suspend the implementation of the instruction until it has been confirmed or modified by the customer.
3.2 StepStone complies with the terms of this agreement and relevant data protection laws, including the GDPR.
3.3 StepStone shall take appropriate organizational and technical measures in accordance with the relevant data protection laws, including the GDPR and in particular it's Art. 32, to protect the personal data of the data subjects and their rights and freedoms, taking into account implementation costs, the state of the art, nature, extent and purpose of the processing and the likelihood and severity of the risk. These measures are recorded in the overview of technical and organizational measures, which is included below as Appendix 2. The technical and organizational measures are subject to technical progress and further development. To that extent, StepStone is obliged to take account of developments in the latest technological standards when reviewing the effectiveness and making corresponding modifications. Alternative security measures are permitted if they at least comply with the security level of the specified measures. Any material modifications must be documented.
Substantial modifications after conclusion of the agreement shall be communicated to the customer without undue delay. If the measures are modified to such an extent that the customer does not consider that StepStone can guarantee equivalent or higher protection of the data, the customer has the right of termination without notice following the issue of instructions to no avail. The same applies in the event of a failure to give notice of such modifications.
3.4 StepStone shall provide the customer with the information required for the records of processing activities under Art. 30 para. 1 GDPR and, to the extent required by law in accordance with Art. 30 para. 2 to 5 GDPR, shall maintain its own record for all categories of processing performed on behalf of the customer.
3.5 All persons who are able to access personal data processed for the customer in accordance with the agreement must be subjected to a duty of confidentiality in accordance with Art. 28 para. 3 b) GDPR and notified of the particular data protection duties arising under this agreement as well as the existing obligation to adhere to instructions and the purpose limitation.
3.6 StepStone has appointed a data protection officer. Its current contact details are easily accessible on the homepage of StepStone.
3.7 StepStone guarantees the protection of the rights of data subjects and shall support the customer in responding to applications for the safeguarding of the rights of data subjects in accordance with Art. 12-23 GDPR.
StepStone informs the customer immediately if data subject directly addresses StepStone for the purpose of accessing, rectification, erasure or to restriction of processing his personal data.
StepStone supports the customer in carrying out data protection impact assessments pursuant to Art. 35 GDPR and the resulting consultation of the supervisory authority in accordance with Art. 36 GDPR to the extent necessary. StepStone supports the customer with regard to ensuring the reporting and notification obligations in the event of data breaches as defined in Articles 33 and 34 GDPR.
3.8 StepStone shall notify the customer without undue delay in text form in the event of any disruptions to the operational processes, the suspicion of data protection breaches under Art. 4 no. 12 GDPR in connection with the data processing or any other irregularities in processing the customer's data.
3.9 In the case of investigations by the data protection authority at StepStone, the customer is to be informed immediately as far as these investigations concern the subject matter of the contract.
3.10 In the event that StepStone intends to process data from the customer, including transmission to a third country or to an international organization, without having been instructed by the customer, i.e. because StepStone is obliged to do so in accordance with Article 28 (3) sentence 1 a GDPR, StepStone will inform the customer without delay about the purpose, legal grounds and data concerned, unless prohibited by law.
4.1 StepStone shall provide the customer with all information required to evidence the obligations set down in this agreement and , subject to adequate prior notice and during standard business hours (9:00 a.m. - 6.00 p.m.), shall enable the customer prior to and during the term of this agreement to perform checks, including inspections, in accordance with Art. 28 para. 3 h) GDPR. Before and during the data processing, the customer is entitled to satisfy itself that the technical and organisational measures are being complied with, or it may retain suitable third parties with an obligation of professional confidentiality to do so, at StepStone's business premises during regular business hours subject to timely notification without disrupting business operations. The outcome of these checks will be documented and signed by both parties.
4.2 The technical and organisational measures may also be evidenced by presenting current certificates, reports or extracts of reports by independent bodies (e.g. external auditorsinternal auditors, Data Protection Officer, IT security team, data protection auditors, quality auditors) or a suitable certification by IT security or data protection audit (e.g. based on BSI principles) for this purpose.
5.1 With conclusion of the contract, the subcontractors listed in Appendix 1 below are approved. StepStone may assign agreements to subprocessors if it notifies the customer in writing in advance of the involvement or replacement of new subprocessors and the customer raises no objection within 4 (four) weeks. If customer objects, then StepStone may cease to provide the comment functionality according to para. 1.2 of the Additional terms and conditions CV database, respectively the applicant management functionality according to Sec. 1.3 of the Additional terms and conditions StepStone Recruiter-Space.
5.3 Further outsourcing by the subcontractor requires the express consent of the main processor (at the minimum in text form. All contractual provisions in the contract chain shall be communicated to and agreed with each and every additional subcontractor.
Upon request from the customer, StepStone will delete data processed on behalf of the customer. StepStone will delete all data processed on behalf of the customer when the contract for the use of the Recruiter Space terminates. In the application management functionality, StepStone will delete the data at the latest one year after receipt of the application in the applicant management functionality.
The customer consents to the use ot the following subprocessors:.
StepStone uses Akamai as part of the technical and organizational measures as Web Application Firewall and therefore delivers its webcontent to website users through Akamai to protect its systems.
Akamai Technologies GmbH schaltet als Subunternehmer Akamai Technologies, Inc ein.
The data centers have a multi-layered security structure. The perimeter of data centers is protected by high security fencing and walls. The entrances are staffed with security guards, 24x7 hours. Surveillance cameras are used to monitor the locations. Access to the computer room is protected by a magnetic card system. The equipment is stored in locked cabinets.
The outer boundary of the data centers is secured by high-security fences and walls. The entrances are guarded around the clock, video camera systems are used for full surveillance. Access to the computer rooms is protected by a card-based access control system.
Extensive safety precautions also exist at the relevant locations StepStone. Card-based access control systems are used and visitors will have to be granted access.
The Customer can only access the data processed on its behalf after logging in to the customer space with the password that was defined by the user. StepStone stores the user authentication details in encrypted form, only.
By default, the user-system data flow is end-to-end encrypted using the Transport Layer Security (TLS) protocol.
StepStone uses Akamai's services as a web application firewall to its systems.
StepStone has an internal password policy for it's employees which requires i.a. passwords to be at least 8 characters long, not to be the same or similar to the user name, to contain at least 3 of the following 4: i) Upper case letters e.g. A,B,C, ii) Lower case letters e.g. a,b,c , iii) Numbers e.g. 1,2,3 iv) Symbols e.g. @,#,+, to be regularly changed.
The Customer's access rights are strictly limited to access only such personal data that is actually processed on its behalf. Only selected StepStone personnel can access the personal data processed on behalf of the Customer on a need to know basis within pre-defined rights and only for the purposes of system administration and customer service purposes on request of the customer.
The system logs all events about the data processed on behalf of the customer.
The processing of personal data in such a method/way, that the data cannot be associated with a specific Data Subject without the assistance of additional Information, provided that this additional information is stored separately, and is subject to appropriate technical and organisational measures.
Does not apply, because the customer needs to see the full details of an applicant.
All data sent over public networks is end-to-end encrypted using the Transport Layer Security (TLS) protocol.
The StepStone systems log the activities of any login and logout as well as the editing, adding, altering, and deleting by recording user, actions and time (through a timestamp).
Antivirus as well as Firewall and other security solutions in place to guarantee safety. StepStone uses Akamai's services as a web application firewall to its systems.
The hosting environment is equipped with fire detection system, water leak detection system in rooms below the raised floor. Temperature and humidity are constantly monitored to ensure that the pre-defined specifications are continuously met. Hosting infrastructure is equipped with continuous supply with life span from at least 72 hours.
We have regular audits of our Information Security standards and processes with external providers. Network penetration scans are performed regularly.
We track and review logs at two levels before any requests reach our application servers. These are at a firewall level and at a WAF (Web Application Firewall) level.
This allows us to track all unordinary presentation layer requests to database being analysed and actively blocked, preventing SQL injection attempts. The application itself tracks any failed login attempts if the request has gone through the Firewall and WAF.
Data protection measures are continuously reviewed in a PDCA cycle.

References: sui generis
sui generis
 Art. 28
 Art. 28
 Art. 45
 Art. 4
 Art. 30
 Art. 32
 Art. 30
 Art. 30
 Art. 28
 Art. 12
 Art. 35
 Art. 36
 Art. 4
 Art. 28