Data Processing Agreement

This Data Processing Agreement forms part of the agreement between Recruitsome (Processor) and the Customer (Controller) and applies as soon as the Customer processes personal data via the platform. On matters of data protection it prevails over the Terms of Service.

The Customer is the controller and determines purpose and means. Recruitsome is the processor and processes personal data only for the Customer and on its documented instructions, unless a legal obligation provides otherwise.

The subject, nature and purpose of the processing and the categories of data subjects and data are set out in Annex 1. The processing lasts for as long as the agreement is in force.

Recruitsome processes only on the Customer's documented instructions, including what follows from the agreement and the use of the platform. If Recruitsome considers an instruction to breach data-protection law, it will notify the Customer.

Recruitsome binds the persons who have access to the personal data to confidentiality.

Recruitsome implements appropriate technical and organisational measures in accordance with art. 32 GDPR. These are set out in Annex 2 and may be updated; the level of protection remains at least equivalent.

The Customer gives general authorisation for engaging sub-processors. The current list is in Annex 3 and on the sub-processor page. Recruitsome imposes at least the same obligations on sub-processors and announces intended changes in advance, against which the Customer may object on reasoned grounds within 30 days.

Recruitsome assists the Customer, as far as reasonably possible, in meeting data-subject requests (access, rectification, erasure, restriction, objection, portability). Requests received directly by Recruitsome are forwarded to the Customer.

Recruitsome informs the Customer without undue delay, and in principle within 48 hours of becoming aware, of a personal-data breach, and provides the information the Customer needs to meet its notification duty (art. 33 and 34 GDPR).

Recruitsome provides reasonable assistance with data-protection impact assessments (DPIAs) and prior consultation of the supervisory authority.

Transfers outside the EEA only take place under a valid transfer mechanism — an adequacy decision or the EU-US Data Privacy Framework, or Standard Contractual Clauses with additional measures — as indicated per sub-processor.

Recruitsome makes available the information needed to demonstrate compliance and allows audits, at most once a year and with reasonable notice, or more often if a supervisory authority or an incident requires it. Each party bears its own costs.

After the service ends, Recruitsome deletes or returns the personal data, at the Customer's choice, within 60 days, unless retention is legally required.

The liability regime of the Terms of Service applies to this agreement, without prejudice to art. 82 GDPR.

Categories of data subjects: candidates, applicants, placed employees, client contacts and the Customer's users.

Categories of data: identity and contact data, CV and career data, communications, and — for payroll — special/sensitive data such as BSN, IBAN and ID document.

Purpose: providing the recruitment and placement services via the platform. Duration: the term of the agreement.

• encryption of special fields (incl. BSN, IBAN) and encrypted transport (TLS);
• logical separation of customer environments (a separate database per tenant);
• role-based access control, strong authentication and logging;
• regular backups and recovery procedures;
• regular security testing and patch management;
• incident and data-breach management procedures.

The current list of sub-processors — with service, location and transfer basis — is on the sub-processor page and forms part of this annex.