# ATS integration terms These terms apply to applicant tracking systems (ATS), career sites, agencies and other partners that integrate with Joonow to **send jobs** or **receive applications**. They complement the [terms of use](/en/terms-of-use) and the [privacy policy](/en/privacy-policy). By turning on an integration, or by continuing to use an integration after a change to these terms, the partner agrees to them on behalf of its own company. Joonow is operated by HERO TECNOLOGIA LTDA, CNPJ 23.073.946/0001-83, headquartered in Brazil. ## Who is who - **Partner:** the provider of the recruitment system, or the site, that integrates with Joonow. - **Client company:** the company that uses the partner's system and owns the jobs. It decides whom to hire and is the controller of candidates' data in its hiring process. - **Candidate:** the person who applies through Joonow. - **Joonow:** gathers the jobs, shows them to the public and, when the applications integration is turned on, delivers the application the candidate confirmed to the partner's system. ## Sending jobs The partner may send jobs by XML feed or in the way agreed in the [partner specification](/en/integrate-your-ats/specification). By sending jobs, the partner guarantees that: - it has each client company's authorization to publish its jobs on Joonow; - the jobs are real, open and carry accurate information (Joonow only publishes jobs from countries in the Americas; jobs from elsewhere stay off the site), including the country, the city (or where the person can work from, if the job is remote), the language of the ad and the application link; - it removes closed jobs from the feed promptly; - the jobs comply with the law of the job's country and with the content rules in the [terms of use](/en/terms-of-use) (no charging candidates, no discrimination, no scams). The partner gives Joonow a free, non-exclusive, worldwide license to store, display, index, reformat, summarize in listings and promote the jobs, with the link to apply, while they are in the feed. Joonow may refuse jobs, group them as duplicates or take them down when they break these rules or look like fraud. **Email of the person responsible for the job:** if the partner sends the work email of the person responsible for the job, Joonow uses that email only to talk about the job (a report or a correction), never shows it to the public or to candidates, and deletes it within 30 days after the job comes down. The partner guarantees that it may share that email for this purpose and that the person has been informed. ## Receiving applications When the applications integration is turned on for a partner, the candidate applies on Joonow itself and Joonow delivers the application to the partner's system, which registers the candidate on the client company's behalf. ### How it is turned on - The partner provides an HTTPS address to receive applications (webhook) and receives from Joonow a secret key to verify the signature of each delivery. - Joonow only sends applications for jobs that came from that partner, or from companies that connected it as their recruitment system. - The partner guarantees that it has a contract with each client company authorizing it to receive and process applications on the company's behalf, with the data protection obligations the law requires (such as a data processing agreement). ### What is sent Only the data the candidate filled in and saw on screen before confirming: name, email, phone, city and country, the links provided, the résumé file (through a temporary signed link, or in the delivery itself), profile data (work history, education, skills, languages, salary expectations), answers to the job's questions, the job's identifier in the partner's system, the date and a unique delivery identifier. The format and versions are in the specification. Sensitive data is only sent when the candidate chose to provide it and the job asked for it (for example, disability in an affirmative-action job), and it is marked as such. ### Data protection roles - **Joonow** processes the application as a controller until delivery, because the candidate asked Joonow to make the delivery. - The **client company** becomes the controller of the data received. - The **partner** processes the data as the client company's operator (processor), only on its instructions. - If the partner uses the data for any purpose of its own, it becomes liable for that use as a controller, and that use needs its own legal basis and notice to the candidate. Nothing in these terms authorizes that use. ### Permitted and prohibited use The partner may only use the data received for the hiring process of the client company that owns the job and for what that company's privacy policy allows. The partner may not: - sell, rent or share the data with other client companies, including putting the candidate in another company's talent pool without the candidate's consent; - use the data for marketing, data enrichment or to train artificial intelligence models that do not serve only that company; - make solely automated decisions about the candidate on Joonow's behalf, or present Joonow's compatibility score, when sent, as a decision about the candidate; - ask the candidate for any payment. ### Security of receipt The partner agrees to: - receive only over HTTPS with TLS 1.2 or newer; - verify the signature of each delivery with the secret key and reject deliveries without a valid signature or outside the time window stated in the specification; - treat the delivery identifier as unique (the same delivery sent again does not create two records); - respond with success only after storing the application; Joonow retries for up to 72 hours, at increasing intervals, and then notifies the candidate and the partner of the failure; - keep the secret key safe, rotate it when we ask or when it suspects a leak, and not record the content of applications in open logs; - maintain technical and organizational measures appropriate to the risk, such as access control, encryption and backups. ### Candidates' rights - The partner helps the client company handle candidates' requests (access, correction, deletion and others). - When a candidate asks Joonow to correct or delete their data, Joonow notifies the partner through an event in the integration. The partner passes it on to the client company promptly and confirms what was done within 15 days. - The partner may send back the application status (received, under review, closed), so the candidate can follow it on Joonow. Joonow shows that status only to the candidate. ### Incidents The partner notifies Joonow within 48 hours of learning of a security incident involving data received through the integration, with what is known at that point, and cooperates to notify candidates and authorities within the legal deadlines. ### Transfers to other countries If the partner receives or stores the data outside the candidate's country or outside Brazil, it guarantees that the transfer has a basis in the applicable law (such as an adequacy decision or standard contractual clauses) and, when asked, tells Joonow where the data is kept and which sub-processors it uses. ### Retention and end of the integration The partner keeps the data for the period set by the client company and never longer than necessary. If the integration ends, deliveries stop; what has already been delivered follows the client company's rules, and these terms continue to apply to that data. ## Brand and promotion The partner may say that it integrates with Joonow and use the Joonow name for that purpose, without suggesting that Joonow endorses its products. Joonow may mention the partner as an available integration. Neither party uses the other's brand in any other way without authorization. ## Suspension and termination Joonow may pause a partner's feed or application deliveries, with notice and the reason, when candidates are at risk (fraud, a job that charges candidates, a security failure, a signature that was not verified) or when these terms are breached. The partner may end the integration at any time through the dashboard or through [Contact us](/en/contact). ## Confidentiality Keys, credentials and technical information exchanged for the integration are confidential and may only be used for it. ## Price The integration program is free. If that changes, we will give at least 30 days' notice, and the partner may end the integration at no cost. ## Liability Each party is liable for what it does in breach of these terms and of data protection law. The partner is liable to Joonow for any use of the data received beyond what these terms allow. To the extent permitted by law, neither party is liable for lost profits or indirect damages, except in cases of willful misconduct, gross negligence or breach of data protection rules. ## Changes to these terms We may update these terms. The date of the last update is shown at the top of the page. Partners are notified of significant changes at least 30 days in advance, except when the changes come from the law or are urgent to protect candidates. ## Governing law and jurisdiction These terms are governed by the laws of Brazil. The courts of São José do Rio Preto/SP have jurisdiction. The data protection rules of each candidate's country continue to apply to that candidate's data. ## Contact Questions about the integration or these terms: [Contact us](/en/contact). Partner program: [Integrate your ATS](/en/integrate-your-ats).