Data processing agreement

Why this agreement exists

When you publish a job ad on CruitUp, candidates send their applications through our service. You decide why and how their data is used; we store and process it for you. Under the GDPR that makes you the controller and [Company legal name] the processor. This agreement sets out the rules for that processing and forms part of our Terms of service. It applies automatically when you accept the Terms; no separate signature is needed.

Scope and definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in the GDPR. "Customer" is the company using CruitUp; "Services" are the services described in the Terms.

Subject and duration

We process personal data only to provide the Services. This agreement lasts as long as we process personal data for the Customer and ends automatically when that processing ends.

Order of precedence

If this agreement and the Terms conflict on data protection, this agreement prevails.

Nature and purpose of processing

We host job ads and application forms, receive and store applications, show them in the applicant board, send notifications, and provide related support. We do not use candidate data for our own purposes, and we never sell it or use it to train models for other customers.

Categories of data subjects

• Candidates who apply to the Customer's job ads;
• The Customer's employees and users who work with applications.

Types of personal data

• Identification and contact data: name, email, phone number, location;
• Application data: CV, cover letter, work history, education, skills, salary expectations, answers to screening questions, and attachments;
• Process data: application status, interview dates, notes and ratings added by the Customer;
• Technical data: time of application and the channel or campaign that brought the candidate.

The Customer must not ask candidates for special categories of data (such as health or religion) unless the law allows it for the role.

Rights and obligations of the Customer

The Customer is responsible for the lawfulness of the processing, including informing candidates and having a legal basis. The Customer gives instructions through the settings of the Services or in writing; these Terms and this agreement are its complete instructions at the time of signing up.

Obligations of CruitUp

• We process personal data only on documented instructions from the Customer, unless the law requires otherwise, in which case we inform the Customer first where allowed.
• We help the Customer respond to data subject requests and with data protection impact assessments, as far as the nature of the processing allows.
• We notify the Customer without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting its data, and support its investigation.
• At the end of the Services, we delete the Customer's personal data within 90 days, unless the law requires us to keep it. The Customer can export applications before deleting the account.

Audits

We provide the information needed to show that we meet our obligations. The Customer may audit us, or have an independent auditor bound by confidentiality do so, with 30 days' notice, during business hours and no more than once a year unless there is a breach. Each side bears its own costs.

Subprocessors

The Customer authorises us to use the subprocessors listed in Appendix 2. We bind each of them to data protection obligations at least as strict as these. We announce new subprocessors at least 30 days in advance; the Customer may object for a valid data protection reason, and if we cannot resolve it, end the affected Services.

Where a subprocessor processes data outside the EU or EEA, we ensure an adequate level of protection, for example through the Standard Contractual Clauses.

Confidentiality

Everyone at CruitUp with access to personal data is bound to confidentiality and receives data protection training. Access is limited to people who need it to provide or support the Services.

Technical and organisational measures

We maintain the measures described in Appendix 1 and adapt them to the state of the art. We may change them as long as the level of protection does not drop.

Miscellaneous

• Liability under this agreement follows Article 82 GDPR and the limits in the Terms, as far as the law allows.
• This agreement is governed by the same law as the Terms ([country of incorporation]).
• If a provision is invalid, the rest remains in force.

Technical and organisational measures

1. Access control: data centres run by certified providers (ISO 27001), with physical access limited to authorised staff.
2. System access: unique accounts, strong passwords, two-factor authentication for staff, automatic session timeouts.
3. Data access: role-based permissions on a need-to-know basis; customer data is separated logically per account.
4. Transfer control: encryption in transit with TLS 1.2 or higher; no transfer on removable media.
5. Encryption at rest: databases, backups and file storage are encrypted.
6. Input control: logging of administrative access and changes to customer data.
7. Availability: daily encrypted backups, monitoring and an incident response process.
8. Separation: development, test and production environments are separated; production data is not used for testing.
9. Supplier control: subprocessors are selected for their security and bound by written agreements.
10. Review: measures are reviewed at least once a year and after any security incident.

Subprocessors