Terms and Conditions


Terms and Conditions

  1. Scope


StepStone NV/SA (hereinafter referred to as “StepStone“) and the undersigned business partner (hereinafter referred to as “Customer“) agree to fulfil the performance of their contract pursuant to these Terms and Conditions and the price list. StepStone’s Terms and Conditions together with the price list contain the whole agreement between StepStone and the Customer. Any terms and conditions of the Customer do not apply, unless StepStone explicitly consents to them in writing.


The version of StepStone’s Terms and Conditions in force at the time of the last concluded contract with the Customer, shall apply to the relationship between StepStone and the Customer. These Terms and Conditions only apply to business Customers and not to consumers. 2. Conclusion of Contract

2.Closing of contract


The contract is concluded when StepStone receives the signed acceptance of the contract offer, which shall contain the date and signature of the Customer. Amendments and additions to the contract as well as statements and individual instructions must be made in writing. Faxes are considered to be a written form. Electronic form, including email is excluded.

  1. Description of Services


The contract obliges StepStone to publish the products and perform the services agreed upon in the contract, displayed at www.stepstone.be (“Service Elements“) in accordance with these Terms and Conditions. The publishing period in relation to access to application service provider products shall be at least 20 hrs per day. The description of services in our Additional Terms and Conditions applies in addition.


The contract entitles StepStone to use Customer data for trend analysis and surveys, however, results shall be published anonymously.


Non-competition clauses are not accepted.

  1. Remuneration


Payment for the services performed by StepStone is set out in the price list given to the Customer. The price list which was in force and given to the Customer at the time when the offer was made to the Customer shall be valid. Services that are not included in the StepStone price list are subject to individual agreements between StepStone and the Customer.

  1. Conditions of Payment


Payment referred to in section 4, includes all additional costs such as e-mails, telephone calls, fax, data transmission, copies and postage which are usually incurred. The cost of corrections and proof-reading that have occurred as a result of the Customer supplying incorrect data are not included. StepStone will inform the Customer if the additional costs exceed the average amount in relation to individual orders. The Customer is obliged to pay StepStone for these additional costs if he has consented to them.


If a Service Element is published containing an error, the first correction of the incorrect Service Element is free of charge provided that the error was not caused by the Customer’s faulty performance. Thereafter every additional correction shall be charged for according to StepStone’s price list valid at the time when the order for correction was made. However, if StepStone makes a mistake in the first correction, the first additional correction shall be free of charge.


The Customer will be invoiced immediately after the first rendering of a Service Element and at the latest 14 days after the conclusion of the contract if no Service Element has been rendered due to the fault of the Customer. Payment is due 10 days after receipt of the invoice, without deductions. When a default in payment or a deferment of payment has occurred, interest will be charged at the rate of 8% above the base rate of the European Central Bank and collection costs will also be charged. In case of default in payment, the debtor has to pay a compensation for the extra judicial cost, and without the need of a notice of default, an amount of 10% payable on the invoice due, with a minimum of 200 euro the invoice, unless the actual collection costs, including costs for legal assistance, would be higher.In the event of a default in payment, StepStone can suspend further performance of the contract until the payment has been made in full. This shall not apply if the Customer is entitled to assert a right of retention. If the parties agreed on payment by instalments, and an instalment is not paid 30 days after the due date, the whole of the remaining amount shall become payable immediately.


All prices exclude any VAT legally payable on the date of the invoice.


If payment is made from abroad, cheques for less than 1,000 Euros will only be accepted if an administration charge of 25 Euros is paid in addition. Payment by bank transfer from abroad will only be accepted if all bank fees and expenses are paid by the Customer.


We reserve the right to send all invoices and correspondence in relation to invoices such as but not limited to dunning letters only as an attachment in an email. On that account, the customer undertakes to provide StepStone with a valid email address and to promptly inform StepStone of any changes in email address.


  1. The Basis of Co-operation


StepStone is committed to continually optimise the number of responses to Advertisements of the Customer and to improve the quality and quantity of the searchable applications. This includes working together with several co-operation partners in offline or online media. The Customer hereby gives StepStone the right to publish Service Elements without prior notice in online and offline media, print media and audio and video media. StepStone pays special attention to the image and quality of its co-operation partners.


The Customer’s rights under this contract are neither transferable nor assignable. The contract can only be transferred to a third party with StepStone’s consent.


After concluding this contract, the Customer agrees to receive by e-mail or post questionnaires, newsletters and other commercial communications that help StepStone to improve and maintain its quality standard. The Customer can withdraw his consent at any time without formal requirements and the withdrawal of consent will be immediately effective.


StepStone reserves the right to not execute orders placed by the Customer or to withdraw Service Elements that have already been published if they breach legal provisions, official regulations, the rights of third parties or good morals (“Illegal Content“). This also applies if links included in the Customer’s Service Elements lead directly or indirectly to pages containing Illegal Content. The Customer’s payment obligation remains unaffected. StepStone shall only be obliged to remove Illegal Content that breaches legal provisions and/or at the request of the Customer. The Customer undertakes to indemnify StepStone and hold Stepstone harmless against all payments and legal costs incurred due to Illegal Content or breach of law on first demand.


In particular this includes following content:

  • If a self employed or freelance job is posted it must be made explicitly that the job is self employed or freelance.
  • If the candidate has to make payments or investments (including training and/or travel fees) this must be made explicitly clear in the Service Element. The same applies where a commission is paid for the attraction of new members to a closed system.
  • Service Elements must refer to a specific vacant position or job.
  • Ads for club memberships and ponzi schemes, pyramid sales or similar are not allowed.
  • Service Elements must specify the job position correctly and must not be misleading
  • Websites that are linked to must comply with legal requirements
  • Any Service Elements that violate anti discrimination law
  • Even if the aforesaid requirements are met no content must be published besides the content related to the position or job that is irrelevant to the job search, such as e.g. competitions, events without career relevance, mere sales campaigns etc.
  • Direct links to external job offers that are not published by StepStone are not permitted.

If these requirements are not fulfilled the content shall be deemed Illegal Content as per 6.4.


StepStone bears no responsibility for received data, texts for Advertisements or the corresponding storage media, and in particular is not obliged to preserve or return these items to the Customer.


StepStone is entitled to use vicarious agents.


The Customer is responsible for configuring and arranging his infrastructure in accordance with the prevailing state of the art so that it becomes neither a target nor a source of disruptions which could affect the Internet service supplied by StepStone or trouble and fault free network operation in general.


The Customer guarantees that all of his content or parts thereof published by him on the Internet or given to StepStone for publication are not encumbered by third party rights. The Customer shall indemnify StepStone and hold Stepstone harmless against any damage StepStone suffers from an infringement of this provision by the Customer on first demand.

  1. Intellectual Property Rights


This contract does not transfer any (intellectual) property right, licence or right of use from StepStone to the Customer. All of Stepstone’s rights (including but not limited to copyright, trademark rights, sui generis database rights, logos, titles as well as any other commercial rights) remain StepStone’s (intellectual) property without restriction.


All material and content published by StepStone are subject to StepStone’s intellectual property rights (copyright, trademark rights and sui generis database rights), except for the individual elements of such material and content designed by the Customer or a third party that are already subject to a Customer’s or third party’s intellectual property rights and that have not been modified/revised by StepStone.


By placing the order for publishing job listings on the Internet, the Customer acknowledges that StepStone is the producer of the database of such job listings and has the sole database right to the Customer’s job listings published in the database by StepStone.


The Customer is responsible for ensuring that the content to be published complies with press law, competition law and other applicable provisions.


The Customer grants StepStone a license to use, reproduce and communicate to third parties the customer data/content/logo/trademark/(trade)name or other signs for purposes of rendering the Service Elements. By placing the order, the Customer warrants that he has purchased or otherwise acquired all necessary user rights, copyrights and ancillary copyrights that are required for StepStone to render the Service Elements (including but not limited to the publication of Customer’s data and content on the Internet).

  1. Warranty


StepStone shall use its best efforts to supply the Service Elements as described in the relevant documentation. If the Service Elements involve the design of software, StepStone will use its best efforts to design software free of errors. The Customer acknowledges that, according to current technical standards, it is not possible or economically reasonable to design a completely error-free program.


The Customer undertakes to provide all information and other documentation required for achieving the objectives set out in the contract. This includes, in particular, the delivery of Advertisement texts and layouts in a digital form. This also includes the Customer’s obligation to immediately inform StepStone if one of the Service Elements becomes outdated. Furthermore, the Customer is obliged to fulfil the requirement to co-operate as described in the corresponding Additional Terms and Conditions or, when available, as described in the product descriptions for the various Service Elements. If these requirements are not fulfilled in time, StepStone’s period of performance shall be prolonged accordingly. This does not apply if StepStone is responsible for the delay in performance.

  1. Liability


Without prejudice to sections 9.2, 9.3, 9.4 and 9.5, StepStone’s entire liability under a contract is limited, to the maximum extent permitted by applicable law and to direct losses (excluding all consequential, special, punitive or incidental damages, damages for loss of profits or revenue, loss of privacy, business interruption, or loss of business information) up to the following amounts:

  • 1.a.

If the damage is caused by a delay in performance by StepStone: 0,5% of the price of the Service Element concerned, per full week (7 days) of delay, up to a maximum sum of 5% of the total contract price for the affected Service Element;

  • 1.b.

If damages are due for any other reason, they shall not exceed 5% of the total contract price.


StepStone is not liable for:

  • 2.a.

The correctness of the data published by StepStone at the request of the Customer or Applicant. StepStone shall not be liable for statements given in this data.

  • 2.b.

The performance of third parties, which the Customer has contracted in order to fulfil the obligations of these Terms and Conditions.

  • 2.c.

For any Force Majeure event such as those set out in section 10.1 below.

  • 2.d.

For a minimum number or minimum quality of applications from Candidates to the Customer’s Job Listings.

  • 2.e.

For investments made by the Customer in relation to the contract and in anticipation of a minimum number of applications.


If the contractually guaranteed usage of a Service Element is limited by protection rights of third parties, StepStone may, at its own expense, either change such Service Element to avoid such limitation or obtain the necessary permission to use such Service Element in compliance with third party rights. These measures should not result in the functionality of the Service Element being unreasonably limited for the Customer. If the Customer becomes aware of protection rights of third parties, the Customer is obliged to immediately inform StepStone hereof in writing.


The Customer must make all claims for compensation within one year from the date on which the Customer noticed, or should have noticed, the failure.


The limitations on and exclusions of liability for damages under section 9 apply regardless of whether the liability is based on breach of contract, tort (including negligence), strict or product liability, hidden defects, breach of warranty, or any other legal duty, and even if (i) StepStone is advised of the possibility of such damages or if such possibility was reasonably foreseeable and (ii) the damages result from StepStone’s serious fault.

  1. Force Majeure


In the event of unforeseeable incidents that have a substantial effect on the economics of a contract, or in the event of force majeure (both events referred to as “Force Majeure“), the contract will either be adapted accordingly and in good faith (eg. the periods of performance are prolonged for the duration of the Force Majeure), or terminated by StepStone with immediate effect.Force Majeure includes but is not limited to: wars, fire, terrorist attacks, server breakdowns that are beyond StepStone’s control or caused by an insufficient communication infrastructure or the deficient software or hardware of a Customer, cuts in telecommunication networks etc.

  1. Confidentiality


StepStone shall treat as confidential all information delivered pursuant to this contract which is marked confidential. This obligation of StepStone shall also continue after the contract has expired.


Upon accepting the offer, both parties agree to mutually comply with all applicable privacy and data protection laws.


The Customer is advised in accordance with data protection laws that StepStone stores his data in a machine-readable form and uses it according to the purposes of this contract.


It is the Customer’s responsibility to treat any ID, password or username or other security device provided for the use of the services with due diligence and due care and to take all necessary steps to ensure that they are kept confidential, secure, are used properly and are not disclosed to unauthorized persons. The Customer will be held responsible for any usage of his password or his username by third parties unless the Customer provides evidence that the access to such password or username by such third parties has not been enabled by him and that the cause of any such access attained does not lie within his sphere of influence. The Customer must immediately inform StepStone if it is likely or has become known that someone not authorised is using his password or username or if they are being or are likely to be used in any unauthorized way. In the event of a breach of any material obligations of the Customer under this contract, in particular including but not limited to the infringement of any obligation described in this section, StepStone is entitled to immediately interrupt the operation of its services without further notice and without releasing the Customer from any payment obligations.

  1. Term


This agreement shall be effective from the date on which StepStone receives a signed version of the contract. The term agreed therein shall begin with the rendering of the first Service Element. If the Customer is responsible for the late rendering of the first Service Element the contract shall, at the latest, begin 14 days after the date StepStone receives the signed contract. This contract terminates automatically after the agreed period has expired, unless the Additional Terms and Conditions set out below contain different provisions.


Service Elements can only be ordered during the agreed contractual period. The Client’s right to order Service Elements that have not been claimed before the termination of the contract shall end with the termination of the contractual period.

  1. Miscellaneous


The laws of Belgium shall exclusively apply to this contract. The courts of Brussels shall have exclusive jurisdiction for disputes arising out of this contract.


Place of performance for all legal relationships between StepStone and the Customer shall be Brussels.


Additional Terms and Conditions Advertisements

These Additional Terms and Conditions for job listings, banners and company presentations (“Advertisements“) apply in addition to our General Terms and Conditions and prevail in case of doubt.

  1. Description of Services


StepStone shall publish Advertisements on the Internet on behalf of the Customer in accordance with section 3 of the General Terms and Conditions.


The content to be published must comply with following requirements; otherwise they are considered as illegal content with the consequences as per clause 6.4 of StepStone’s General Terms and Conditions:

– Within a job ad only links to online application forms or the company’s online presence are allowed.

– Links to competitors of StepStone are not allowed unless the customer itself is competitor of StepStone and links to its own online presence.

– All content of a job ad must be directly visible to the user. The Customer’s own tracking codes are not permitted unless they do not process personal data. Links to external sites must open in a separate window and must be designed in such way that it is perceivable that they link to external pages.

– Links are permitted only as “no follow” links, i.e. they must be set in such way they are not used by search engines to evaluate the link popularity.

– Visibility products are available for StepStone customers in addition to the publication of job ads. StepStone reserve the right not to publish visibility campaigns that would not meet the standards of quality that we set.


In addition, StepStone is entitled, but not obliged, to publish Advertisements in other media, offline or online or by print or to distribute Advertisements to third parties for further publishing. StepStone co-operates with media partners for this purpose, and hosts the StepStone Job board or parts thereof at further URLs without requesting prior approval from the Customer. A list of co-operating media partners can be requested from StepStone. StepStone will not charge any additional fees for such additional performance.


The advertisement must advertise a specific job and function and must not advertise anything else; in particular the advertisement must not mention any recruitment events of the customer unless it is part of the selection process for the job specifically advertised in the job advertisement.


StepStone reserves the right to convert the display layout of job ads in order to improve the listing quality across all devices.


Upon customers request StepStone will publish a button in relation to the job advertisements that is labeled with “Apply Now” or similar. Depending on the customer’s selection, this button can either link to a page designated by the customer or to a standardized application form operated by StepStone on its platforms, with which the applicants can provide the data requested through the form and have them transmitted by StepStone to the customer. The customer can receive the application at his choice in the StepStone Recruiter Space. StepStone will then submit the application to the specific account of the customer in the applicant management functionality in the StepStone Recruiter Space.


The above description of services is comprehensive.

  1. Duration of Publication


Unless otherwise agreed, a job listing is displayed for a period of 30 days, a banner for a period of 7 days.


Users with a Personal StepStone Account can store job listings in their Personal StepStone Account for up to six months. The stored job listings will be accessible beyond the actual contract period in accordance with number 2.1 for these users.3. Anonymous Advertisements

  1. Anonymous advertisements


StepStone offers to publish anonymous Advertisements. Incoming electronic applications will be forwarded without adaptation or viewing the content to an e-mail address of the Customer. StepStone is not responsible for the content of such forwarded applications. Only electronic applications will be considered for forwarding, offline applications will not be forwarded. Also, applications with a clear lock flag will not be forwarded. StepStone is not liable for the content of the applications. StepStone reserves the right to delete applications with obvious Illegal Content (as described in section 6.4 of the General Terms and Conditions).The Customer is obliged to treat anonymous Advertisements in accordance with local laws and data protection regulations. The Customer indemnifies StepStone on first demand against all claims of third parties arising from the Customer’s failure to comply with legal or data protection provisions.

  1. Other


The Customer is advised and agrees that StepStone cannot prevent the unapproved publication of job listings by third parties. StepStone shall however, subject to technical and legal limitations, use its best efforts to prevent such unapproved publication.


The Customer shall hereby assign to StepStone any rights in the ownership of a database that may exist with respect to any multiple Advertisements delivered to StepStone for publication. In particular, the Customer acknowledges that StepStone is the producer of the database of such job listings and has the sole database right to the Customer’s job listings published in the database by StepStone.


An offer from StepStone for a price lower than the price mentioned in the price list is only valid in relation to the specific Customer and under the specific conditions such an offer was made by StepStone. It is not valid for a Customer who wants a third party, for example, an agency to act on his behalf.


The transfer of an Advertisement Agreement (“Reselling“) to a third party requires StepStone’s prior consent.


StepStone continually endeavours to optimize the search result at www.stepstone.be, having the goal to achieve optimal results for customers. As far as the categorization of advertisements is done by the customer, the customer is obliged to do these in a correct and reasonable way. StepStone reserves the right to amend the categorization in its discretion. The customer cannot claim publication of his advertisements in specific categories selected by him.


StepStone uses a specific layout for the cross-device optimised display of job ads. Therefore, StepStone converts job ads from any layout automatically in an optimised structure of content for cross-device readability without charging additional fees.


Additional Terms and Conditions CV Database

1 Description of Services


These Additional Terms and Conditions CV Database apply in addition to our General Terms and Conditions and prevail in case of doubt. StepStone operates databases on the internet which contain CVs of jobseekers (“Candidate”). Candidates can enter their CVs into the databases. By activating the CV the Candidate publishes the CV either in anonymised form, i.e. without making personal data publicly accessible (“anonymised CV”), or in such a way that that his personal data are directly accessible in the database (“public CV”). The Customer, that orders an access to the CV database, may directly view public CVs and contact the candidates behind the CV and in case of anonymous CVs may, via the StepStone electronical system, send a contact request to the candidate behind the CV.


Furthermore, as an additional cost-free service, the customer can save comments about candidates whose profiles he can view anonymously or publicly. These comments are saved and processed by StepStone on behalf of the customer in the sense of Art. 28 GDPR; the Additional terms and conditions StepStone Data Processor Agreement apply here. For the sake of clarity, it is specified that the other services provided by the DirectSearch Database are not processed as data processor on behalf of the customer. StepStone merely provides the content stored by the candidate at StepStone’s platforms and remains responsible for data protection as controller. As far as the customer uses this data, he may become a separate and independent controller.


StepStone only grants access to the CV Database to Customers for their own personal needs. No Customer may forward access to the CV Database or anonymous CVs to third parties. It is not allowed to access the CV database for enticement of customers. No Customer may place deep links from his own web site to the CV Database (“Deep Links”). StepStone reserves the right to take immediate legal action against any infringement of this clause without giving any prior warning notice.


The Customer may make use of certain functionalities in the “CV-Center”. The service does not include any data backup for the Customer. Data may be removed or deleted from the back-office at any time without giving prior warning. Data will automatically be removed from the CV-Center for data protection reasons as soon as a Candidate deletes his CV from the CV Database. The CV database must not be used for any purposes violating antidiscrimination law.


If the Customer saves the personal data of Candidates on his own systems he is obliged to comply with further monitoring duties. Should a Candidate delete his CV from the StepStone Database and the CV Center, the Customer is obliged to immediately delete such data from his own systems. He is then also obliged to destroy any related hard copies.


The Customer is entitled to contact up to 500 CVs from the CV Database per month through the CV Database.1.6In case on anonymised CVs Candidates may block certain companies from accessing their CV. In such cases the respective Customer can not send a contact request to the Candidate.

2 Obligations of the Customer


The Customer warrants that he will comply with all legal provisions, third party rights and good morals. Section 6(4) of the General Terms and Conditions shall prevail.


In particular, the Customer warrants not to forward or otherwise communicate the personal data of Candidates, to respect their confidentiality and to comply with all applicable data protection and privacy rules. The Customer is advised that, if a Candidate should approach StepStone requesting the deletion of any data relating to the Candidate, and StepStone thereafter gives notice to the Customer of this request, the Customer is obliged to delete any hard copy or electronic files or data relating to a certain Candidate Profile immediately.

StepStone assumes that storage is required for a maximum period of 12 months, also taking into account possible defenses against antidiscrimination claims, so that the customer undertakes to retain any data stored by him and received by StepStone no later than 12 months after accessing the Delete data. StepStone reserves the right to block the customer’s access in the event of an infringement


The Customer undertakes to indemnify StepStone against all losses, costs, claims, damages or other expenses that are caused by the Customer, unless StepStone is responsible.


Candidates are responsible for completing their Candidate Profiles. Therefore, StepStone does not warrant their completeness, correctness, accuracy or accessibility. StepStone does not warrant any degree of response.


The data of jobseekers registering on the StepStone sites (“Candidates”) is strictly confidential and may only be stored, or used according to applicable data protection laws. The Customer is only entitled to contact Candidates for filling certain vacancies. StepStone is entitled to block the account of the Customer and withhold access to Candidate data in cases of infringements by the Customer.


The Customer is advised that special terms apply to data transfers outside the European Union. Generally, such data transfers require the consent of the Candidate – even if the transfer occurs within a corporate group.

  1. Price models


Depending on the specific price model agreed upon the Customer can access a predefined number of CVs in the CV Database for one month or pays per accessed CV or per number of searches he ran and may contact up to 500 CV profiles individually in order to fill a specific open position, in case of public CVs directly and in case of anonymous CVs after prior contact request. The number of contacts is limited to 500. Mass emails and spam mails are not permitted.


Additional Terms and Conditions Job Feed

These Additional Terms and Conditions Job Feed apply in addition to the General Terms and Conditions and prevail in case of doubt.

  1. Description of Services


By ordering the Job Feed Services, StepStone is obliged to automatically mirror the job listings on the Customer’s web site on the StepStone web site during the contractual period. The mirroring process is fully automated. Every Advertisement of the Customer will be published in an identical form. Additional manual changes are not provided. This description of services shall be deemed as an agreement of functionality and is comprehensive. No other functionalities are granted.


Job Feed is a complex software solution. A good co-operation between the parties ensures its successful implementation and the expected functionality. The current Job Feed product description and the Job Feed technical documentation contain obligations of the Customer and conditions precedent for a successful usage of the program. The Customer is obliged to read this documentation before the Job Feed Services start. The Customer is advised that its content will be considered as known.

  1. Term


The term shall be agreed individually. Contrary to the General Terms and Conditions, StepStone shall delete published job listings after these are deleted from the Customer’s database, and StepStone shall publish job listings after they were entered into the Customer’s database.


The Job Feed data mirroring will take place at least once per week.

  1. Booking and Acceptance


Any Job Feed listing published on the StepStone site in the described form and any additional job listing published after or during the initial publishing period of four weeks shall be considered as booked by the Customer. A job listing shall be considered as accepted if it has been published for seven days on the StepStone site without the Customer rejecting its publication.


StepStone shall count the job listings that were booked and accepted during the contract period and shall provide the Customer with a performance confirmation if requested.


Additional Terms and Conditions Company Pop-Up

These Additional Terms and Conditions Company Pop-Up apply in addition to our General Terms and Conditions and prevail in case of doubt.

  1. Description of Services


StepStone shall publish a presentation of the Customer’s company as a pop-up on the Internet (“Company Pop-Up“) on behalf of the Customer.


The Company Pop-Up shall be published during the second and third times a user uses the site per week. It contains a link to the Client’s Advertisements published by StepStone. The size must not exceed 200 x 263 pixels.


This description of services is considered to be an agreement of functionality and is comprehensive. Further functionalities are not granted.

  1. Term


Company Pop-Ups will be published for a period of 7 days unless other periods have been agreed by the Parties.

  1. Non Binding Offer


Only one Company Pop-Up will be published on the StepStone site per week. The Customer is not entitled to claim a specific publishing date. Of course, StepStone will try to consider the Customer’s requirements as far as possible. The Customer shall usually receive a notice of the publishing date within 3 days, but at the latest one week after receipt of the order.


StepStone is entitled to change the position of the Company Pop-Up on the site or the design of the frame. StepStone is also entitled to adjust the Company Pop-Up to comply with local legal provisions.


Additional Terms and Conditions StepStone Boost

These Additional Terms and Conditions StepStone Boost apply in addition to our General Terms and Conditions and prevail in case of doubt.

  1. Description of Service


StepStone shall, on behalf of the Customer, publish a standard graphical banner (“Boost”) on the Internet, which is linked to the Customer’s job listing published on the StepStone Site. This is to increase traffic.


Boost can only be linked to one job listing. As soon as the job listing is offline, Boost is terminated.


The position of the Boost banner shall be decided by StepStone. Therefore the Customer has no right to have the banner positioned in a specified place.


The ad-server of the online provider shall be authoritative for the purposes of calculating click-rates.


No Agency Commission is granted for StepStone Boost.


The standard graphical banner must not exceed 468 x 60 / 12 KB in size. The StepStone logo will be implemented on the right side of the banner.

  1. Term


Boost shall be published for a maximum of 30 days. Boost will be switched offline after 500 clicks even if the maximum of 30 days has not been achieved.


Additional Terms and Conditions Video Ads

  1. Description of Service


On behalf of the Customer StepStone publishes short videos that have been produced with the Customer’s involvement containing information about Customer and open positions on the internet (“Video Ads”). These Additional Terms and Conditions Video Ads apply in addition to our General Terms and Conditions and prevail in case of doubt


This description of services is comprehensive.

  1. Rights of use


For such Video Ads that have been produced by StepStone, Customer agrees that StepStone owns the rights of use unrestricted by time or place in the Video Ads for all exploitation methods including but not limited to the right of reproduction, distribution, broadcasting and the making available right. StepStone may grant licenses.


After StepStone’s prior approval, Customer may use the Video Ads for its own purposes on its website or on websites of cooperation partners. StepStone will not unreasonably withhold approval. StepStone may make the approval subject to additional payment, unless the Video Ad was produced by Customer. The Customer must not publish the Video Ad on other job boards.


If Customer has produced the Video Ad he shall not be entitled to publish the Video Ad without StepStone’s prior approval, unless otherwise is agreed. StepStone may also use the Video Ad on websites of its cooperation partners worldwide.


Additional Terms and Conditions StepStone Recruiter Space

These Additional Terms StepStone Recruiter Space apply in addition to our General Terms and Conditions and prevail in case of doubt.

  1. Description of Services


The term set out in section 12.1 of the General Terms and Conditions applies. StepStone grants the Customer the non-exclusive, non-transferable right to use the StepStone Recruiter Space during the contractual period. StepStone shall provide the Customer with the job listing tool StepStone Recruiter Space for 20 hours a day at http://www.stepstone.fr/corporate/index.cfm. The Recruiter Space enables the Customer to edit and publish Advertisements on his own. This description of services is considered to be an agreement of functionality and is comprehensive. No other functionalities are granted.


StepStone provides the Customer with a user ID and a password for accessing the server. The Customer may change his password at any time. Within the scope of his general responsibilities, the Customer must ensure that his user ID and password can only be used by persons who are authorised to access the StepStone Recruiter Space. The Customer is also obliged to consider any additional security criteria he has been informed about. If an agency acts on behalf of a Customer, the same provisions apply. StepStone will grant agencies access rights to the listings of their Customers so that they have the possibility of administering listings and of placing new listings on behalf of their Customers. For this purpose, the agencies will be provided with access to statistics, current contractual data and old listings placed on behalf of the Customer. To do so, the agency must obtain the prior approval of its Customer and produce this to StepStone, if required by the latter. The agency shall be liable if a Customer makes a claim against StepStone because of a potentially unauthorised dissemination of access rights and information.


If an application was submitted to the customer in accordance with para. 1.6 of the Additional terms and conditions Advertisement into the specific account of the customer in the applicant management functionality in the StepStone Recruiter Space, the customer can view this application there and also take notes on the respective candidate and, depending on the functionality, set a status of the application and communicate with the applicant.


In connection with the application, the client can also access the applicant’s MyStepStone profile via the applicant administration. However, this accessibility to the MyStepStone profile exists only as long as it is active, i.e. if the applicant changes his settings or deletes his profile, access to the profile is no longer possible. The application data submitted by the applicant remain unaffected.


  1. Data Protection


Within the scope of the services under para. 1.3, StepStone processes personal data on behalf of the customer as a processor in the sense of Art. 28 GDPR; the Additional Terms and Conditions StepStone Data Processor Agreement apply in this context. The services under para. 1.4 are not carried out as data processor, StepStone provides the content stored by the applicant at the StepStone platform and remains controller under data protection law; As far as the customer uses this data, he may become a separate and independent controller.


Additional Terms and Conditions Online Ordering

These Additional Terms and Conditions Online Ordering apply in addition to our General Terms and Conditions and our Additional Terms and Conditions Advertisements, and prevail both in case of doubt.

  1. Description of Services


StepStone publishes Advertisements on the internet on behalf of the Customer in accordance with section 2.1 of the Additional Terms and Conditions Advertisements.


This description of services is comprehensive.

  1. Written Form


Contrary to StepStone’s General Terms and Conditions the mandatory written form shall not apply. Declarations of intent can be executed by both parties without any formal requirement and they shall be valid.

  1. Terms of Payment


No agency commission is granted for Online Ordering.


Generally, the Customer can choose to pay by direct debit or within 10 days of receipt of an invoice. In all other cases the provisions of sections 4 and 5 of the General Terms and Conditions shall apply.

  1. Customer Information Obligations

Pursuant to Belgian law StepStone confirms the following information:


The Online Ordering service is supplied by, Stepstone NV/SA, Wolstraat 70 Rue aux Laines, B-1000 Brussels, tel +32 2 209 98 00, fax +32 2 218 79 45, e-mail: cs@stepstone.be, registered company number 0459.971.228, VAT no. BE 459.971.228. The supervisory authorities responsible for regulating for Stepstone’s activities can be contacted as follows:

  • For Flanders: Ministerie van de Vlaamse Gemeenschap, Administratie werkgelegenheid, Markiesstraat 1, 1000 Brussel, tel +32 2 553 44 12+32 2 553 44 12, fax +32 2 553 44 01, Internet http://www.werk.be/wg/arbeidsbemiddeling/documenten/lijst_bemiddeling_algemeen.pdf?SMSESSION=NO
  • For Wallonia: Ministere de la Région Wallonne, Direction générale de l’économie et de l’emploi, Place de la Wallonie, 1, 5100 Namur, tel + 32 81 33 43 43+ 32 81 33 43 43, fax +32 81 33 38 88, Internet http://emploi.wallonie.be/THEMES/Placement/Agr_placement.htm#10
  • Brussels Dutch: Brussels Hoofdstedelijk Gewest, Bestuur Economie en Werkgelegenheid, dienst Werkbeleid, Kruidtuinlaan 20 (derde verdieping), 1035 Brussel, tel: +32 2 204.21.11+32 2 204.21.11, fax + 32 2 800 38 07, Internet http://portail.irisnet.be/cmsmedia/nl/lijst_van_de_partners_van_actiris.xls?uri=43742a96031fc020010321e1dc6500be
  • Brussels French: La Région de Bruxelles-Capitale, l’Administration de l’économie et de l’emploi, Direction de la politique et de l’emploi, Boulevard du Jardin Botanique 20, 1035 Bruxelles, tel + 32 2 204 21 11+ 32 2 204 21 11, fax + 32 2 800 38 07, Internet http://portail.irisnet.be/cmsmedia/fr/liste_des_agences_d_emploi_privees.pdf?uri=ff80818119970beb0119999b9e920050

The contract with the Customer shall be concluded once the following technical steps have been completed:

  • The order form including the advertisement template is completed
  • Advertisement preview is displayed on every page until the placing of the order
  • The Customer reads and accepts the Terms and Conditions
  • The Customer clicks on “placing order”
  • The Customer is sent an electronic acknowledgement of receipt of the order (this is not the order confirmation, but the confirmation that the order was received)
  • Order confirmation from StepStone

The contract is concluded when the Customer receives StepStone’s order confirmation. Thereafter the Advertisement will be published online.


These Terms and Conditions (General Terms and Conditions, Additional Terms and Conditions Advertisements and Additional Terms and Conditions Online Ordering) together contain the entire terms of the contract for the online ordering of an Advertisement. The price for Online Ordering is defined and published at www.stepstone.be when the Customer receives StepStone’s offer to enter into a contract. The legal relationship resulting from the (free of charge) visit to the StepStone web site is explained and defined in detail in our Terms of Use.


Additional Terms and Conditions Video Interview Service


The video job interview service (“Video Interview Service”) allows customers to a) create customized automated job interviews and/or b) conduct live job interviews (the “Video Interview“). An automated job interview is a structured way of interviewing where the customers’ candidate (Candidate”) answers a pre-recorded set of questions with a video recording at their convenience. The live job interview is a real-time interactive online conversation between a Candidate and one, or multiple, interviewer(s).


The web-based software system on which the Video Interviews are generated (the “System”), stored in a database specific to the customer and are made available to the customer through this.


The System may also be used for live video interviews using a webcam (see section 1 lit. b above).


The customer is not permitted to give third parties access to the System e.g. by letting them perform Video Interviews with its Candidates, unless expressly agreed otherwise in the agreement.


The price for the Video Interview Service is calculated according to the number of Video Interviews conducted on the basis of the contractually agreed unit price.

A Video Interview has been conducted if a) the Candidate provided its recorded video or b) the customer has carried out the live job interview with the Candidate.




StepStone has the right to delete the recorded Video Interviews from the System after one-hundred-and-eighty (180) days


Additional Terms and Conditions StepStone Data Processor Agreement

  1. StepStone acting as Processor

1.1 In the context of the comment functionality according to para. 1.3 of the Additional terms and conditions CV database and the applicant management functionality according to Sec. 1.3 of the Additional terms and conditions StepStone Recruiter-Space, as well as in the context oft he use of the Video Interview Service, StepStone processes personal data as a processor in the manner described in each case for the purpose described therein on behalf of the customer in accordance with Art. 28 GDPR, observing the following provisions.

1.2 StepStone processes the personal data solely within the framework of the contract and in accordance with the documented instructions of the customer unless there is an exceptional case within the meaning of Article 28 (3) (a) GDPR.

1.3 The processing takes place exclusively in member states of the European union or in another contracting state of the agreement over the European economic area, as far as no other instruction was given and a transmission in accordance with the regulations of Artt. 44 to 49 GDPR is allowed. Already upon conclusion of the contract, in the context of the measures to be taken under section 4.3 StepStone is instructed to transfer personal data to the other subcontractor Akamai Technologies, Inc., 150 Broadway, Cambridge, 02142 MA, USA, as described in Section 6 below. This transfer is permitted under Art. 46 (2) lit. c GDPR, since the Standard Contractual Clauses of the European Commission (‘EU Model Clauses’) has been concluded with Akamai Technologies and the customer entered into the EU Model Clauses already according of that agreement. The customer may also directly enter into the EU Model Clauses with Akamai Technologies. These are available under https://www.akamai.com/de/de/multimedia/documents/akamai/akamai-pre-signed-eu-standard-contractual-clauses.pdf. Akamai Technologies’ Data Protection Officer may be contacted at privacy@akamai.com.

1.4 The duration of the processing corresponds with the duration of the use of the Recruiter Space, whereby, at the end of the term of contract about the publication of job adverts or the Direct Search Database, the respective access is disabled, upon conclusion of a new contract, the access is reactivated, unless the contract for the use of the Recruiter Space was terminated in the meantime. The duration of the contract data processing shall be equivalent to the duration of the use of the Video Interview Service.

1.5 Data subjects in the context of the applicant management functionality are persons who have applied for a job vacancy with the Customer through the StepStone application form. Data subjects in the context of the Direct Search Database are natural persons who have a profile with StepStone. In the context of the use of the Video Interview Service, data subjects are persons who have applied for an open position with the customer via the Video Interview Service, where the customer uses the Video Interview Service of StepStone.

1.6 The type of personal data used in the context of the processing for the applicant management functionality consists of CV data, such as contact details, educational records, work experience and knowledge and interests, and any other data submitted by the candidate, and data entered by the customer such as comments created by the customer or an application status created by the customer as well as in case of using the Video Interview Service a) the recorded candidate videos, when an application video is created by the Candidate or b) the e-mail address and name of the Candidate to conduct a live Interview.

In the context of Direct Search, the types of personal data are the comments made by the customer about the persons concerned in connection with the filling of vacancies.

1.7 The subject matter and purpose of the processing is, in the context of applicant management functionality, that the application data submitted by applicants can be made available and viewed in the StepStone Recruiter Space to the customer after his login in the Recruiter Space. If the customer creates a comment or status of the application (depending on the function) in order to manage it, it will also be saved there. If a status of the application can be created, the customer instructs StepStone when entering a status to inform the applicant immediately about this status.

Subject matter and purpose of the processing in the context of the Direct Search is, that the customer can save comments about candidates whose profiles the customer can access through the Direct Search.

Within the scope of the Video Interview Service, the object and purpose of the processing is to transmit the Video Interview created by the applicant to the customer by making the videos available in the customer-specific account. If the Video Interview is used by the client, the purpose of the processing is the online transmission of the real-time interactive online conversation of candidates and one, or multiple, interviewer(s).

1.8 References in these Additional Terms and Conditions StepStone Data Processor Agreement to the General Data Protection Regulation (GDPR) shall be interpreted as references to the corresponding provision in the national data protection legislation until 24.05.2018. Unless there is a corresponding provision in the national legislation, the said obligation shall not apply until 24.05.2018 and will only apply with effect from 25.05.2018.

  1. Obligations of the customer as client

2.1 In accordance with Art. 4 No. 7 GDPR, the customer is controller of the data processed by StepStone in accordance with the contract.

2.2 The customer informs StepStone immediately and completely if it finds errors or irregularities regarding data protection regulations when checking the outcome of the processing.

2.3 The customer keeps a register for processing activities in accordance with Art. 30 para. 1 GDPR.


  1. Obligations of StepStone as contractor

3.1 StepStone informs the customer immediately if StepStone believes that an instruction violates applicable laws. StepStone may suspend the implementation of the instruction until it has been confirmed or modified by the customer.

3.2 StepStone complies with the terms of this agreement and relevant data protection laws, including the GDPR.

3.3 StepStone shall take appropriate organizational and technical measures in accordance with the relevant data protection laws, including the GDPR and in particular it’s Art. 32, to protect the personal data of the data subjects and their rights and freedoms, taking into account implementation costs, the state of the art, nature, extent and purpose of the processing and the likelihood and severity of the risk. These measures are recorded in the overview of technical and organizational measures, which is included below as Appendix 2. The technical and organizational measures are subject to technical progress and further development. To that extent, StepStone is obliged to take account of developments in the latest technological standards when reviewing the effectiveness and making corresponding modifications. Alternative security measures are permitted if they at least comply with the security level of the specified measures. Any material modifications must be documented.
Substantial modifications after conclusion of the agreement shall be communicated to the customer without undue delay. If the measures are modified to such an extent that the customer does not consider that StepStone can guarantee equivalent or higher protection of the data, the customer has the right of termination without notice following the issue of instructions to no avail. The same applies in the event of a failure to give notice of such modifications.

3.4 StepStone shall provide the customer with the information required for the records of processing activities under Art. 30 para. 1 GDPR and, to the extent required by law in accordance with Art. 30 para. 2 to 5 GDPR, shall maintain its own record for all categories of processing performed on behalf of the customer.

3.5 All persons who are able to access personal data processed for the customer in accordance with the agreement must be subjected to a duty of confidentiality in accordance with Art. 28 para. 3 b) GDPR and notified of the particular data protection duties arising under this agreement as well as the existing obligation to adhere to instructions and the purpose limitation.

3.6 StepStone has appointed a data protection officer. Its current contact details are easily accessible on the homepage of StepStone.

3.7 StepStone guarantees the protection of the rights of data subjects and shall support the customer in responding to applications for the safeguarding of the rights of data subjects in accordance with Art. 12-23 GDPR.

StepStone informs the customer immediately if data subject directly addresses StepStone for the purpose of accessing, rectification, erasure or to restriction of processing his personal data.

StepStone supports the customer in carrying out data protection impact assessments pursuant to Art. 35 GDPR and the resulting consultation of the supervisory authority in accordance with Art. 36 GDPR to the extent necessary. StepStone supports the customer with regard to ensuring the reporting and notification obligations in the event of data breaches as defined in Articles 33 and 34 GDPR.

3.8 StepStone shall notify the customer without undue delay in text form in the event of any disruptions to the operational processes, the suspicion of data protection breaches under Art. 4 no. 12 GDPR in connection with the data processing or any other irregularities in processing the customer’s data.

3.9 In the case of investigations by the data protection authority at StepStone, the customer is to be informed immediately as far as these investigations concern the subject matter of the contract.

3.10 In the event that StepStone intends to process data from the customer, including transmission to a third country or to an international organization, without having been instructed by the customer, i.e. because StepStone is obliged to do so in accordance with Article 28 (3) sentence 1 a GDPR, StepStone will inform the customer without delay about the purpose, legal grounds and data concerned, unless prohibited by law.

  1. Audits including inspections

4.1 StepStone shall provide the customer with all information required to evidence the obligations set down in this agreement and , subject to adequate prior notice and during standard business hours (9:00 a.m. – 6.00 p.m.), shall enable the customer prior to and during the term of this agreement to perform checks, including inspections, in accordance with Art. 28 para. 3 h) GDPR. Before and during the data processing, the customer is entitled to satisfy itself that the technical and organisational measures are being complied with, or it may retain suitable third parties with an obligation of professional confidentiality to do so, at StepStone’s business premises during regular business hours subject to timely notification without disrupting business operations. The outcome of these checks will be documented and signed by both parties.

4.2 The technical and organisational measures may also be evidenced by presenting current certificates, reports or extracts of reports by independent bodies (e.g. external auditors internal auditors, Data Protection Officer, IT security team, data protection auditors, quality auditors) or a suitable certification by IT security or data protection audit (e.g. based on BSI principles) for this purpose.

  1. other processors

5.1 With conclusion of the contract, the subcontractors listed in Appendix 1 below are approved. StepStone may assign agreements to sub-processors if it notifies the customer in writing in advance of the involvement or replacement of new sub-processors and the customer raises no objection within 4 (four) weeks. If customer objects, then StepStone may cease to provide the comment functionality according to para. 1.2 of the Additional terms and conditions CV database, respectively the applicant management functionality according to Sec. 1.3 of the Additional terms and conditions StepStone Recruiter-Space.

5.2 StepStone shall impose the same data protection obligations as set out in this agreement on the sub-processors so that the processing will meet the requirements of the GDPR. If the subcontractor fails to comply with its data protection obligations, StepStone shall be liable to the customer under Art. 28 para. 4 sent. 2 GDPR for that subcontractor’s compliance with its obligations

5.3 Further outsourcing by the subcontractor requires the express consent of the main processor (at the minimum in text form. All contractual provisions in the contract chain shall be communicated to and agreed with each and every additional subcontractor.

5.4 Services that are procured from third parties as an ancillary service to support the performance of the agreement shall not be deemed subcontracted. These include e. g. telecommunication services, maintenance and user service, cleaners, auditors or the disposal of data media. However, in agreement to guarantee the protection and the security of the customer’s data, StepStone is also obliged to enter into adequate and legally compliant agreement and to perform checking measures for ancillary services that are procured from third parties

  1. Erasure and return

Upon request from the customer, StepStone will delete data processed on behalf of the customer. StepStone will delete all data processed on behalf of the customer when the contract for the use of the Recruiter Space terminates. In the application management functionality, StepStone will delete the data at the latest one year after receipt of the application in the applicant management functionality.



Appendix 1 – List of sub-processors to the Terms and Conditions StepStone Data Processor Agreement

The customer consents to the use ot the following sub-processors:.


Company Address Services
StepStone GmbH Axel-Springer-Str. 65,
10969 Berlin
– hosting and associated security services

– back up services

– Customer service support for trouble-shooting

StepStone Continental Europe GmbH Völklinger Straße 1, 40219 Düsseldorf
– hosting and associated security services

– back up services

– Customer service support for trouble-shooting

StepStone N.V. Tweed building
Reception – 5th floor
Wolstraat 70 Rue aux Laines
1000 Brussels
– hosting and associated security services

– back up services

– Customer service support for trouble-shooting

StepStone Services sp. z o.o. ul. Domaniewska 50, 02-672 Warschau,
Customer service support for trouble-shooting
Akamai Technologies GmbH Parkring 20-22
85748 Garching
StepStone uses Akamai as part of the technical and organizational measures as Web Application Firewall and therefore delivers its webcontent to website users through Akamai to protect its systems.


Akamai Technologies, Inc. 150 Broadway, Cambridge, 02142 MA, USA Akamai Technologies GmbH schaltet als Subunternehmer Akamai Technologies, Inc ein.
Amazon Webservices, Inc. 410 Terry Drive Ave North
WA 98109-5210 Seattle
Hosting and associated security services (within the EU)
Cammio GmbH Alexanderstraße 1
10178 Berlin
StepStone uses Cammio to conduct Video Job Interviews                                                                                                   





Appendix 2 – Overview of technical and organizational measures to Terms and Conditions StepStone Data Processor Agreement


1. Confidentiality (Article 32 Paragraph 1 Point b GDPR)  
  • Physical Access Control

No unauthorised access to Data Processing Facilities, e.g.: magnetic or chip cards, keys, electronic door openers, facility security services and/or entrance security staff, alarm systems, video/CCTV Systems


The data centers have a multi-layered security structure. The perimeter of data centers is protected by high security fencing and walls. The entrances are staffed with security guards, 24×7 hours. Surveillance cameras are used to monitor the locations. Access to the computer room is protected by a magnetic card system. The equipment is stored in locked cabinets.

The outer boundary of the data centers is secured by high-security fences and walls. The entrances are guarded around the clock, video camera systems are used for full surveillance. Access to the computer rooms is protected by a card-based access control system.

Extensive safety precautions also exist at the relevant locations StepStone. Card-based access control systems are used and visitors will have to be granted access.

  • Electronic Access Control

No unauthorised use of the Data Processing and Data Storage Systems, e.g.: (secure) passwords, automatic blocking/locking mechanisms, two-factor authentication, encryption of data carriers/storage media

The Customer can only access the data processed on its behalf after logging in to the customer space with the password that was defined by the user. StepStone stores the user authentication details in encrypted form, only.

By default, the user-system data flow is end-to-end encrypted using the Transport Layer Security (TLS) protocol.

StepStone uses Akamai’s services as a web application firewall to its systems.

StepStone has an internal password policy for it’s employees which requires i.a. passwords to be at least 8 characters long, not to be the same or similar to the user name, to contain at least 3 of the following 4: i) Upper case letters e.g. A,B,C, ii) Lower case letters e.g. a,b,c , iii) Numbers e.g. 1,2,3 iv) Symbols e.g. @,#,+, to be regularly changed.

  • Internal Access Control (permissions for user rights of access to and amendment of data)

No unauthorised Reading, Copying, Changes or Deletions of Data within the system, e.g. rights authorisation concept, need-based rights of access, logging of system access events


The Customer’s access rights are strictly limited to access only such personal data that is actually processed on its behalf. Only selected StepStone personnel can access the personal data processed on behalf of the Customer on a need to know basis within pre-defined rights and only for the purposes of system administration and customer service purposes on request of the customer.

The system logs all events about the data processed on behalf of the customer.

  • Isolation Control

The isolated Processing of Data, which is collected for differing purposes, e.g. multiple Client support, sandboxing;

The StepStone Recruiter Space is multi-client capable so that each individual logged in customer can only see data associated with the customer’s account


  • Pseudonymisation (Article 32 Paragraph 1 Point a GDPR; Article 25 Paragraph 1 GDPR)

The processing of personal data in such a method/way, that the data cannot be associated with a specific Data Subject without the assistance of additional Information, provided that this additional information is stored separately, and is subject to appropriate technical and organisational measures.


Does not apply, because the customer needs to see the full details of an applicant.
2. Integrity (Article 32 Paragraph 1 Point b GDPR)  
  • Data Transfer Control

No unauthorised Reading, Copying, Changes or Deletions of Data with electronic transfer or transport, e.g.: Encryption, Virtual Private Networks (VPN), electronic signature;


All data sent over public networks is end-to-end encrypted using the Transport Layer Security (TLS) protocol.



  • Data Entry Control

Verification, whether and by whom personal data is entered into a Data Processing System, is changed or deleted, e.g.: Logging, Document Management


The StepStone systems log the activities of any login and logout as well as the editing, adding, altering, and deleting by recording user, actions and time (through a timestamp).
3. Availability and Resilience (Article 32 Paragraph 1 Point b GDPR)


  • Availability Control

Prevention of accidental or wilful destruction or loss, e.g.: Backup Strategy (online/offline; on-site/off-site), Uninterruptible Power Supply (UPS), virus protection, firewall, reporting procedures and contingency planning


Antivirus as well as Firewall and other security solutions in place to guarantee safety. StepStone uses Akamai’s services as a web application firewall to its systems.

The hosting environment is equipped with fire detection system, water leak detection system in rooms below the raised floor. Temperature and humidity are constantly monitored to ensure that the pre-defined specifications are continuously met. Hosting infrastructure is equipped with continuous supply with life span from at least 72 hours.

  • Rapid Recovery (Article 32 Paragraph 1 Point c GDPR) (Article 32 Paragraph 1 Point c GDPR);


Rapid recovery is ensured by

· Back-up procedure;

· Encryption;

· Uninterrupted power supply (USV);

· Separate storage;

· Virus protection, Firewall;

· Emergency plan, disaster recovery;

· Organisational / Employee Training;


4. Procedures for regular testing, assessment and evaluation (Article 32 Paragraph 1 Point d GDPR; Article 25 Paragraph 1 GDPR) We have regular audits of our Information Security standards and processes with external providers. Network penetration scans are performed regularly.

We track and review logs at two levels before any requests reach our application servers. These are at a firewall level and at a WAF (Web Application Firewall) level.

This allows us to track all unordinary presentation layer requests to database being analysed and actively blocked, preventing SQL injection attempts. The application itself tracks any failed login attempts if the request has gone through the Firewall and WAF.

Data protection measures are continuously reviewed in a PDCA cycle.

Brussels, December 31th 2020