1. Data and purposes
Workly processes names, email addresses, phone numbers, CVs, education, experience, skills and user messages for accounts and applications. Login, technical-event and service-order records may also be generated. Purposes include account management, sending an application to the selected employer, fulfilling paid services, support and abuse prevention. Do not include identity documents, card details, health information or other sensitive information in a CV unless necessary.
2. Sharing a CV
An application shares data with the contact person or employer for that vacancy. Mass distribution is a separate service sharing the CV and application details with the recipient group confirmed in the order. A public candidate profile is different from a private application; public publication must be separately explained and confirmed. Sharing a CV is not marketing consent. The receiving employer is independently responsible for its subsequent use of the data.
3. Providers and safeguards
Hosting, email-delivery, payment and analytics providers may receive data needed for their functions. Current integrations include Brevo email delivery, Epoint payments and panel.olai.az analytics. Provider identities, processing countries and cross-border transfer grounds must be checked for the final document. Full card details are not intended to be stored by Workly; the provider processes payments. Access controls, secure connections and internal controls must be applied; absolute security is not guaranteed.
4. Retention and requests
The final version must approve retention periods for accounts, CVs, applications, sending logs, consent and payment records. This draft does not confirm that automatic deletion is already implemented. Users may ask the operator for access, correction, deletion and cessation of future sharing. An email already sent cannot be recalled from a recipient mailbox. Mandatory retention and records required to resolve disputes are considered separately.
5. Scope and definitions
This policy covers candidates, employer representatives, applicants, paid-service customers and Workly.az subscribers. Operator identity, VÖEN, address and contact details are completed at the beginning. A candidate is a person seeking work; an employer publishes vacancies or receives CVs. Subsequent employer processing may be under that employer’s independent responsibility; Workly remains responsible for its own disclosure activities.
6. Sources and user choices
Sources include submitted forms, uploaded files, account actions, technical logs and connected-provider transaction notifications. Anyone submitting another person’s details must be authorised to do so. Public-profile visibility, a specific job application and a mass-CV order are separate choices; selecting one does not automatically approve the others. If social sign-in is used, the provider information and permissions must be disclosed when connecting.
7. Separate permissions
Account access, application delivery, public profiles, CV disclosure to selected employers and promotional messages are not treated as one undefined purpose. The applicable processing basis is assessed for each purpose. Where consent is required, data categories, purpose and recipients are disclosed. Declining promotions does not by itself stop necessary account or order messages. A separate basis is assessed for new uses incompatible with the original purpose.
8. Recipients and minimisation
Employers receive information needed for the application or candidate’s sending instruction. Technical providers receive the data necessary for their function rather than unrestricted access to the entire database. Authority, scope and legal basis are checked for official disclosure requests. This document does not grant general permission to freely sell the CV database. Statistics should preferentially use indicators that do not identify individuals.
9. Retention schedule
The final version specifies periods: active accounts — __________; closed accounts — __________; CVs and applications — __________; sending and consent records — __________; security logs — __________; backups — __________. Mandatory payment and accounting retention takes precedence. Extensions require an actual dispute or legal obligation. Deletion accounts for backup rotation and legitimately retained records; general indefinite retention is not intended.
10. Requests and incidents
Requests require only the identity and data-link verification necessary to handle them. Full card details, passwords or excessive identity documents should not be requested. The applicable response period and channel are completed here: __________. Unauthorised access or data loss is investigated, impact is contained and required notifications are made. This draft does not certify any particular safeguard, information-system registration or certification.