Levi9 Privacy Policy
1. Scope of this Policy
This Privacy Policy applies to external individuals who share their personal data with Levi9, including job candidates, event participants, newsletter subscribers, customers, supplier representatives, business contacts, website visitors, and other non-employees who voluntarily provide personal data to Levi9.
2. Who is responsible for your personal data (Data Controller)
The Levi9 entity acting as Data Controller is Levi9 Global Sourcing Balkan S.R.L., with the social address in Iasi, Calea Chisinaului no. 22, Silk District Office Park, L3 building, 7th floor, county Iasi, with fiscal registration code RO 18315419, registered at the Trade Register held by the Trade Register’s Office by the Court of Iasi under no. J2007002380220, hereafter referred to as “Levi9”.
3. How we collect your personal data
We collect personal data directly from you when you:
Apply for a job via our job portal or Applicant Tracking System.
Upload or submit your CV or application documents.
Provide consent to be included in our talent pool.
Register for Levi9 online or offline events.
Communicate with Levi9 during recruitment, events, or other professional interactions.
Otherwise voluntarily share personal data with Levi9.
We may also receive personal data from third parties, such as recruitment agencies, publicly available professional platforms (e.g. LinkedIn), business partners, event organizers, or publicly available sources.
4. Types of personal data we process
Depending on the context, Levi9 may process the following categories of personal data:
Identification and contact details (e.g. name, email address, telephone number).
CVs, other documents (cover letters, recommendations, university documents, etc.).
Education, qualifications, employment history.
Interview notes, assessments and recruitment feedback (including automatic transcripts, if applicable).
Information voluntarily provided during event registration – e.g. company, role, years of experience.
Correspondence related to recruitment or events.
Photos and videos captured during the events (if applicable).
Identity card, residence address for pre-onboarding process (if applicable).
Contact people from previous employers (if applicable).
Any other information you choose to provide.
Levi9 does not intentionally collect special categories of personal data as defined in Article 9 GDPR. If such data is voluntarily provided, it will only be processed in accordance with applicable law.
5. Purposes of processing and legal basis
5.1 Recruitment and selection, background screening
Purpose:
Assessing job applications.
Conducting interviews and evaluations.
Communicating with candidates during the recruitment process.
Creating interview notes, transcripts and summaries to support the recruitment process.
Legal basis:
Pre‑contractual steps (Article 6(1)(b) GDPR), and
Consent, where applicable (Article 6(1)(a) GDPR).
Legitimate interest (Article 6(1)(f) GDPR) for the use of AI-assisted transcription and note-taking tools during interviews, in order to ensure the accuracy and consistency of interview records.
To support the recruitment process and ensure the accuracy of interview notes, Levi9 may use transcription and note-taking tools, including AI-assisted tools, during candidate interviews. Candidates will be informed in advance when such tools are used. Candidates may object to the use of these tools during their interview, without this affecting their participation in the recruitment process. Any recruitment decision is always made by Levi9 employees and involves human review.
5.2 Retention for future career opportunities
Purpose:
If you give explicit consent, Levi9 may retain your personal data after the recruitment process ends in order to consider you for future vacancies.
Legal basis:
Consent (Article 6(1)(a) GDPR).
5.3 Compliance with legal obligations
Purpose:
In limited cases, personal data may be processed to comply with legal or regulatory obligations, such as responding to lawful requests from authorities, complying with employment, tax, accounting, audit, or record-retention requirements.
Legal basis:
Legal obligation (Article 6(1)(c) GDPR).
5.4 Marketing communications and events
Purpose:
Levi9 may process personal data for marketing‑related purposes, including organizing and hosting online or offline events, sending event‑related communications, initiatives, or career opportunities, receiving promotional gifts and using image on social media.
Legal basis:
Consent (Article 6(1)(a) GDPR).
5.5. Business relationships
Purpose:
Managing relationships with customers, suppliers and business partners.
Responding to enquiries.
Conducting business development activities.
Legal basis:
Legitimate interest (Art. 6(1)(f)), and
Pre-contractual steps where applicable (Art. 6(1)(b)).
6. Consent and withdrawal
Where processing is based on consent:
consent is given explicitly (for example via the job portal or event registration form).
consent is voluntary and may be withdrawn at any time.
You can withdraw your consent by contacting us at GDPR-Romania@levi9.com.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
7. Retention of personal data
Levi9 retains personal data no longer than necessary for the purposes for which it was collected. The applicable retention period depends on the purpose of processing, applicable legal requirements and legitimate business needs. For recruitment and selection and retention for future career opportunities we will retain your data for a period of 4 years. After this time, we will reach out to you again and ask for consent. In some cases, personal data may be retained for longer periods where required by law or necessary for the establishment, exercise or defense of legal claims.
8. Access to personal data and recipients
Access to personal data is limited to:
Authorized Levi9 employees (e.g. HR, Marketing, etc.).
Recruitment agencies, event organizers, marketing agencies and technical service providers acting under Levi9's instructions.
In some cases, with your permission, your profile can be shared with Levi9 customers.
9. International transfers of personal data
As a rule, we process your personal data in the country where it was collected. Where personal data is transferred outside the country of collection or outside the European Economic Area (EEA), we ensure that an adequate level of protection is in place in accordance with Chapter V GDPR.
This may include transfers to countries with an adequacy decision adopted by the European Commission or the use of Standard Contractual Clauses (SCCs). Where SCCs are used, we carry out a Transfer Impact Assessment (TIA) and apply supplementary measures where necessary.
10. Automated decision making
Levi9 does not use solely automated decision making or profiling that produces legal or similarly significant effects. All decision-making processes involve human review.
11. Security measures
Levi9 processes personal data in accordance with the General Data Protection Regulation (GDPR). Levi9 is ISO 9001, 27001 and 27701 certified. We implement appropriate technical and organizational measures to protect personal data.
In case of a personal data breach, we follow the procedures set out under Article 33 GDPR. Contact for privacy‑related questions or requests: GDPR-Romania@levi9.com.
12. Your rights under the GDPR
You have the right to:
Be informed about the processing of your personal data.
Access your personal data.
Request rectification of inaccurate or incomplete data.
Request erasure (“right to be forgotten”).
Request restriction of processing.
Data portability.
Object to processing.
Withdraw your consent at any time.
Not be subject to automated decision‑making where applicable.
Lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.
To exercise your rights please contact: GDPR-Romania@levi9.com.
13. Changes to this Privacy Policy
Levi9 may update this Privacy Policy when required by internal processes or applicable legislation. The most recent version will always be made available where appropriate.
Last updated: July 2026