BETWEEN:

Jobtoolz BV, having its registered office at 8500 Kortrijk, President Kennedypark 16b, with
company number 0507.743.629
(“Jobtoolz”, “Processor”, “we”)

AND:

The Customer (“Customer”, “Controller”, “you”)

The Processor and Controller shall together be referred to as the “Parties”, and individually as a “Party”.

IT IS AGREED AS FOLLOWS:

1. Article 1 – Subject

1.1 This agreement (“Agreement”) applies to the processing by Jobtoolz, in the context of the “Software-as-a-Service” (“SaaS” or “Services”) provided by Jobtoolz to the Customer, of personal data collected by the Customer (“Personal Data”) in relation to a recruitment process for the purpose of finding suitable employees. This Agreement should be read together with the agreement concluded regarding the provision of the Services (“Master Agreement”).

2. Article 2 – Definitions

2.1 For the purposes of this Agreement, the following terms shall have the following meanings:

• “Personal Data”: any information relating to an identified or identifiable natural person (“Data Subject”), collected by or on behalf of the Customer in the online recruitment dashboard forming part of the SaaS.
• “Data Protection Law”: the legislation applicable to the processing of personal data, in particular Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”) and the Belgian law on the protection of natural persons with regard to the processing of personal data of 30 July 2018.
• “Sub-processors”: any processor engaged by Jobtoolz as a subcontractor who agrees to process Personal Data on behalf of and for the Customer in accordance with this Agreement.

2.2 Other terms are defined and interpreted in accordance with the meaning given to them in the GDPR.

3. Article 3 – Roles

3.1 Jobtoolz shall process the Personal Data on behalf of and on instruction from the Customer. Within the context of the execution of the Master Agreement, the Customer is responsible for the processing of Personal Data, and Jobtoolz acts as the Processor. The Customer autonomously determines the purpose and means of collecting and processing the Personal Data.

3.2 Jobtoolz has no influence on and only limited access to the Personal Data. Jobtoolz does not use the Personal Data for its own purposes and does not provide access to the Personal Data to third parties, whether for marketing or other purposes.

3.3 Both Parties explicitly commit to comply with the relevant provisions of Data Protection Law and shall not take any actions or refrain from taking actions that could cause the other Party to breach Data Protection Law.

4. Article 4 – Processor Obligations

4.1 Jobtoolz shall respond to all reasonable requests of the Customer regarding the processing of Personal Data under this Agreement promptly or as soon as reasonably possible (depending on the legal obligations under the GDPR).

4.2 Jobtoolz shall only process Personal Data in the context of compliance with the Master Agreement and this Agreement and in accordance with the obligations and responsibilities imposed by law, in accordance with the Customer’s written instructions; if Jobtoolz is unable to comply for any reason, it shall notify the Customer.

4.3 Jobtoolz shall immediately notify the Customer if it considers any instruction to be in breach of applicable Data Protection Law.

4.4 Jobtoolz undertakes that access to, inspection of, processing of, and communication of Personal Data shall only occur in accordance with the principles of proportionality and ‘need-to-know’.

4.5 Jobtoolz undertakes not to disclose Personal Data to any other persons, institutions, or entities other than those directly involved in the processing necessary for Jobtoolz to fulfil its obligations under this Agreement. These entities are bound by confidentiality unless otherwise provided in the Master Agreement. Jobtoolz shall, to the extent that can be reasonably expected, assist the Customer in fulfilling its obligation to cooperate with requests and investigations by competent supervisory authorities, insofar as these requests and investigations relate to the Processing within the scope of the Services.

5. Article 5 – Controller Obligations

5.1 The Customer shall provide all necessary assistance and cooperate in good faith with Jobtoolz to ensure that all processing of Personal Data complies with the requirements of the GDPR, and in particular the principles contained therein.

5.2 The Customer shall agree on clear, appropriate channels of communication with Jobtoolz so that instructions, directions, and other forms of communication regarding Personal Data processed by Jobtoolz on behalf of the Customer are always properly received. The Customer shall notify Jobtoolz of the identity of their single point of contact, responsible, among other things, for communication in the event of a Data Breach (see Article 10).

5.3 The Customer undertakes to refrain from giving instructions, directions, or requests to Jobtoolz that would result in a breach of the GDPR or the provisions of applicable mandatory national law.

5.4 The Customer shall provide assistance when Jobtoolz or any of its Sub-processor(s) require it to comply with a request, order, investigation, or writ of summons directed at Jobtoolz or its Sub-processor(s) by a competent national authority or legal authority.

5.5 The Customer guarantees that it will cooperate in good faith with Jobtoolz to mitigate adverse effects of a security incident affecting Personal Data processed by the Processor and/or its Sub-processor(s) on behalf of the Customer.

6. Article 6 – Sub-processors

6.1 The Customer agrees that Jobtoolz may engage Sub-processor(s) in the performance of its obligations under this Agreement and the Master Agreement. Annex 2 includes the list of Sub-processor(s) agreed to by the Customer at the time of conclusion of this Agreement. Jobtoolz shall always inform the Customer of material changes thereto.

6.2 If the Customer does not agree with a particular Sub-processor, they have ten (10) days to object in writing with a motivation. A lack of protest within the ten-day period is deemed to be an acceptance of the Subprocessor in question.

6.3 If the Customer protests the use of a new Subprocessor who will process the Customer’s Personal Data, Jobtoolz will make reasonable efforts to modify the relevant Services or to recommend a commercially reasonable change to the Customer’s use of the relevant Services to avoid the processing of Personal Data by the Subprocessor in question. If Jobtoolz is unable to make or propose such a modification within sixty (60) days, the Customer may terminate the relevant part of the Principal Agreement concerning the Services that cannot be provided by Jobtoolz without using the Subprocessor in question. For this purpose, the Customer must provide a written notice of termination that includes the reasonable motivation for the non-approval. The Customer shall bear the costs incurred in connection with this Article 6.3.

6.4 Jobtoolz guarantees that Sub-processor(s) are bound by the same obligations regarding the processing of Personal Data as Jobtoolz is bound to under this Agreement.

Jobtoolz shall pass on the Customer’s determined purposes and instructions accurately and timely to the Sub-processor(s) insofar as such purposes and instructions relate to the part of the processing in which the Sub-processor(s) is/are involved.

7. Article 7 – Security

7.1 Jobtoolz shall implement appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, or damage. Annex 1 lists these measures.

7.2 Jobtoolz guarantees that authorised persons and (sub-)processors engaged by it shall only have access to Personal Data to the extent necessary to perform their tasks under this Agreement. Jobtoolz ensures segregation of duties to prevent a combination of access rights leading to unauthorised actions and/or access to Personal Data.

7.3 Jobtoolz ensures, to the extent technically feasible, the integrity, availability, and confidentiality of Personal Data using security technologies and techniques.

7.4 Jobtoolz shall adopt technical and organisational measures (cf. Article 32 GDPR) against unauthorised and unlawful processing, and shall regularly evaluate and adjust these security measures according to legal requirements or technological developments. The Customer acknowledges that the SaaS is a standardised service and agrees that these adjustments or improvements may be implemented from time to time, provided the overall measures continue to meet the security level referred to in Article 7.1.

7.5 Activities related to Personal Data shall be logged. The same applies to other relevant events, such as attempts of unauthorised access and disruptions potentially leading to modification or loss of Personal Data.

8. Article 8 – Retention

8.1 Jobtoolz may not make copies of the Personal Data, except for the purpose of back-up or if necessary for the performance of the assignment as described in this Agreement.

8.2 Jobtoolz shall not retain Personal Data longer than necessary for the SaaS-service provision and shall automatically proceed to delete or anonymise Personal Data after termination of the Master Agreement.

9. Article 9 – Confidentiality

9.1 Disclosure by Jobtoolz of Personal Data to third parties shall only occur insofar (i) as legally required or (ii) by court order, or (iii) when the disclosure is made upon instrcution of the Customer. Any legally required disclosure of Personal Data to third parties must be notified to the Customer in advance by Jobtoolz.

9.2 This confidentiality obligation of Jobtoolz shall remain in effect even after termination of this Agreement.

10. Article 10 – Data Breaches

10.1 Jobtoolz shall inform the Customer without undue delay, and at the latest within 48 hours of becoming aware of a data breach, once it has knowledge of an actual or attempted breach of security leading to the destruction, loss, alteration, or unauthorised access to Personal Data (“Data Breach”).

10.2 To the extent known, Jobtoolz shall inform the Customer of a Data Breach, including:

a) the nature of the Data Breach
b) the time the incident was detected
c) the nature and overview of leaked or potentially leaked Personal Data
d) the categories and estimated number of affected Data Subjects
e) the likely consequences of the Data Breach
f) measures taken immediately to mitigate the likely consequences
g) the time of closure of the incident
h) the structural measures Jobtoolz will take or has taken to prevent similar breaches in the future

10.3 The Customer shall be responsible for reporting a Data Breach subject to a statutory reporting obligation to the competent supervisory authority within the legally required timeframe.

10.4 If Jobtoolz engages Sub-processor(s), Jobtoolz shall require that they provide the same information in the event of a Data Breach, which Jobtoolz shall immediately and without undue delay communicate to the Customer.

10.5 Jobtoolz and its Sub-processor(s) shall mutually appoint a single point of contact responsible for all communication between Jobtoolz, the Sub-processor(s), and the Customer in case of an incident potentially causing unauthorised destruction, loss, access, modification, or transfer of Personal Data processed on behalf of the Customer.

10.6 It is exclusively the Customer’s decision whether, in accordance with relevant and applicable Data Protection Law, the Data Subjects affected by a Data Breach must be informed. It is also the Customer’s responsibility to notify the competent national supervisory authority of a Data Breach.

10.7 Jobtoolz shall assist the Customer in fulfilling obligations under Articles 32 to 36 GDPR. Jobtoolz shall assist the Customer when the latter performs a Data Protection Impact Assessment (DPIA), in accordance with Article 35 GDPR. Jobtoolz may charge additional fees for this assistance, proportionate to the services provided.

11. Article 11 – Data Subject Rights

11.1 Considering the nature of the processing, Jobtoolz shall assist the Customer with appropriate technical and organisational measures, to the extent possible, in fulfilling the Customer’s obligation to respond to requests to exercise the rights of Data Subjects under Chapter III of the GDPR.

11.2 Regarding requests from Data Subjects concerning their rights related to Personal Data processed by Jobtoolz and/or its Sub-processor(s), the following conditions apply:

• Jobtoolz shall, to the best of its ability, promptly notify the Customer of any Data Subject request regarding Personal Data processed by Jobtoolz and/or its Sub-processors on behalf of the Customer, without responding to such request unless the Customer has expressly consented;
• Jobtoolz shall promptly comply with any Customer request so that the Customer can comply with a Data Subject request to exercise any of their rights, and shall require its Sub-processor(s) to comply immediately;
• Jobtoolz shall ensure that both itself and its Sub-processor(s) have the technical and organisational means to block access to Personal Data and to physically destroy data without recovery possibility if requested by the Customer;
• Upon simple request by the Customer, Jobtoolz shall, to the best of its ability, provide all required assistance and information necessary for the Customer to defend its interests in legal, arbitration, or other proceedings brought against the Customer or its employees for violation of fundamental privacy rights and protection of Personal Data of Data Subjects.

11.3 The Customer shall bear the reasonable costs of the assistance provided by Jobtoolz under this Article.

11.4 Jobtoolz shall immediately notify the Customer of any request, order, investigation, or writ of summons by a competent national authority or legal authority directed at Jobtoolz or its Sub-processors regardin(g) processing carried out on behalf of the Customer or any related data and/or information.

12. Article 12 – Audit

12.1 The Customer has the right to verify compliance with this Agreement. To this end, the Customer may appoint an independent auditor to visit the premises where Jobtoolz performs processing or provides relevant processing information. The audit results shall be communicated to the Customer in a report upon first request. The Customer shall bear the audit costs, unless a manifest breach of the GDPR, the Master Agreement, or this Agreement is identified during the audit, in which case Jobtoolz shall bear the costs. The Customer shall notify Jobtoolz at least thirty (30) business days in advance of performing an audit. Such audits shall not occur more than once every two calendar years. Audits shall be conducted at a time and in a manner that minimally interferes with Jobtoolz’s daily operations.

12.2 The Customer may request an audit if justified reasons exist, provided these are communicated and demonstrated to Jobtoolz in writing. Justified reasons include strong suspicion of a Data Breach as defined in Article 4 GDPR, destruction of confidential Personal Data, or a material breach of Jobtoolz’s obligations under this Agreement. In such a case and upon written request from the Customer, Jobtoolz shall grant an independent third-party certified auditor appointed by the Customer or relevant supervisory authority access to relevant parts of Jobtoolz’s administration (and that of its agents, subsidiaries, and subcontractors) to verify wheter Jobtoolz complies with GDPR and this Agreement. Deficiencies identified during audits shall be corrected by Jobtoolz through corrective actions within a reasonable period proportional to the severity and complexity of the deficiencies.

13. Article 13 – International Data Transfers

13.1 The Parties agree that Personal Data may only be transferred to and/or stored with recipients located within the European Economic Area (EEA). No additional consent from the Customer is required. If an international transfer occurs to a non-EEA country, it is required that the country has an adequacy decision issued by the European Commission and only if necessary to comply with this Agreement. Such transfers are governed by the terms of a data transfer agreement using model clauses published in the European Commission’s decision of 4 June 2021 (Decision 2021/914), or by other mechanisms provided by applicable data protection law.

14. Article 14 – Liability

14.1 Notwithstanding the Master Agreement, Jobtoolz shall only be liable for direct damage caused by the processing where Jobtoolz has not acted in accordance with the obligations specifically imposed on processors under the GDPR, or where it has acted outside of or contrary to the Customer’s instructions.

The Processor’s maximum liability towards the Controller arising from or in connection with this Data Processing Agreement, with regard to any event and each calendar year (or series of related events), shall, to the extent permitted under applicable law, in no event exceed the amount paid or payable to the Processor by the Controller during the preceding twelve (12) month period.

The foregoing limitations shall not apply to the Processor’s liability arising from (i) fraud or deceit, and/or (ii) wilful misconduct.

14.2 For the avoidance of doubt, it is specified that neither Party shall, under any circumstances, be liable for any indirect, consequential, or other similar damages (including, but not limited to, damages for loss of profit, revenue, business, contracts or customers, loss or corruption of data, loss of goodwill, damage to equipment and reputation, loss of opportunities, or loss of anticipated savings), even if the Party concerned has been advised of the possibility of such costs or damages.

15. Article 15 – Intellectual Property Rights

15.1 All intellectual property rights regarding Personal Data and databases used in the context of the processing are reserved for Jobtoolz, unless contractually agreed otherwise. Nothing in this Agreement shall constitute a transfer of intellectual property rights from Jobtoolz to the Customer, unless otherwise contractually agreed between the Parties.

16. Article 16 – Commencement and Termination

16.1 This Agreement commences upon the start of SaaS service provision by Jobtoolz to the Customer and automatically terminates upon termination of the SaaS service (the Master Agreement), for any reason.

16.2 In the event of a breach of the Master Agreement or applicable GDPR/data protection law provisions, the Customer may instruct Jobtoolz to immediately cease further processing of Personal Data.

16.3 Upon termination of the SaaS service, Jobtoolz shall deliver Personal Data to the Customer in a .csv file or destroy it, at the Customer’s discretion.

16.4 If the Master Agreement is terminated, or if Personal Data is no longer relevant for service provision, Jobtoolz shall anonymise or pseudonymize the Personal Data as much as possible.

17. General Provisions

17.1 This Agreement constitutes the entire agreement between the Parties regarding processing of Personal Data under the SaaS service and may only be amended in writing with the consent of all Parties.

17.2 In the event of a conflict between Jobtoolz’s general terms or privacy policy and the provisions of this Agreement, the provisions of this Agreement shall prevail, unless otherwise evident.

17.3 If any provision of this Agreement is null and void, voidable, or otherwise unenforceable, the remaining provisions shall remain in full force. The Parties shall consult to replace the unenforceable provision with a valid alternative, taking into account the purpose and intent of the original provision.

17.4 This Agreement is governed by Belgian law. All disputes regarding existence, content, or performance shall be submitted to the competent courts of the judicial district of Jobtoolz’s registered office.

This Agreement has been attached to the order form and is therefore fully accepted without reservation.

Annex 1 – Jobtoolz Description of Technical and Organisational Measures

Organisational measures:

• Access to backend systems is restricted to authorised personnel.
• Employees, contractors, and third parties are required to enable two-factor authentication where possible.
• Clean desk policy is implemented.
• Computers are locked when leaving the workplace.
• Hard drives of employees, contractors, and third parties are encrypted.
• Internal compliance checks are conducted regularly.
• Employees, contractors, and third parties are aware of security threats, responsibilities, and obligations.
• Awareness training is provided where relevant.
• Institutional email addresses and approved collaboration tools are used for communication of Personal Data.
• Procedures for incident response, reporting, and handling are in place. ●
• Jobtoolz works only with reputable third parties and ensures appropriate processor agreements are in place.

Technical measures:

• Servers are in private networks, accessible via VPN.
• Data is transmitted over HTTPS.
• Accounts are secured by username/password; two-factor authentication optional.
• Passwords are encrypted and weak passwords detected automatically.
• Candidate data is only accessible within their customer account.
• Backups are encrypted and regularly performed.
• End-user information is obfuscated to prevent readability

Annex 2 – Sub-processors