1. Our Approach
Stepli processes different categories of personal data in different legal roles. We distinguish between data for which Bewort decides the purposes and means of processing, and data we process on behalf of our Customers.
2. When Bewort Is Controller
Bewort acts as controller for Customer account and billing information, and for professional business contact information that Stepli independently sources and maintains. For business contact information, we rely on our legitimate interests, subject to the GDPR requirements of necessity, balancing, transparency and the right to object. People whose business contact information we hold can read our Notice for Business Contacts.
3. When Bewort Is Processor
Customers act as controller and Bewort acts as processor for data Customers bring to or create in Stepli, including candidate CVs and profiles, mailbox content and replies, manually added contacts, and CRM notes and activities. This processing is governed by our Article 28 Data Processing Agreement, which every Customer accepts together with the Terms.
4. Customer Outreach
When a Customer uses business contact information for its own outreach, the Customer acts as an independent controller for that outreach and is responsible for determining whether its communications are lawful and for complying with privacy, electronic communications, marketing and anti-spam rules. Unsubscribe links and opt-out replies are honoured for the Customer concerned, and anyone can ask us to remove them from Stepli entirely.
5. Infrastructure and Providers
Stepli's primary application hosting is in the European Union (Frankfurt, Germany). We also use specialised providers for payments, authentication, mailbox connectivity, artificial intelligence, data enrichment, email verification and security. Customers can request the list of sub-processors at legal@stepli.io and are notified by email before a sub-processor is added or replaced.
6. International Transfers
Where personal data is transferred outside the EEA, we use an applicable GDPR transfer mechanism, such as an adequacy decision, the EU-US Data Privacy Framework for certified recipients, Standard Contractual Clauses, or another lawful safeguard.
7. Security
We use technical and organisational measures appropriate to the nature of the processing and the associated risks, including encryption in transit, encryption at rest of our primary database, access controls, logging and automated backups.
8. Data Breaches
Our breach obligations depend on our role. When Bewort acts as processor, we notify the affected Customer without undue delay after becoming aware of a breach involving Customer-controlled data. When Bewort acts as controller, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours where the GDPR requires it, and we inform affected individuals where the breach is likely to result in a high risk to them.
9. Data Subject Rights
Where Bewort acts as controller, requests may be sent to legal@stepli.io; we respond within one month. Where Bewort acts only as processor, requests should normally go to the relevant Customer, and we help that Customer respond.
10. Contact
Bewort sp. z o.o., ul. Ostrobramska 101, 04-041 Warsaw, Poland, legal@stepli.io.