Data Processing Agreement

data processing agreement

Data Processing Agreement

This Data Processing Agreement ("Agreement") forms part of the Master Services Agreement or other written or electronic agreement between Workdune ("Processor") and the customer entity ("Controller") that governs the delivery of Workdune services (collectively, the "Service").

By using the Service, Controller instructs Processor to process personal data as necessary to provide the Service and associated support in accordance with this Agreement.

1. Definitions

  • Controller, Processor, Data Subject, Personal Data, and Processing have the meanings set out in the EU General Data Protection Regulation (GDPR).
  • Sub-processor means any third party engaged by Processor that processes Personal Data on behalf of Controller.

2. Subject matter and duration

Processor will process Personal Data solely to deliver the Service, perform documented instructions from Controller, and fulfil related support obligations. Processing will continue for the duration of the underlying agreement and until deletion or return of Personal Data has been completed.

3. Nature and purpose of processing

Processor handles Personal Data to:

  • match candidates and roles based on Controller's configuration;
  • provide dashboards, analytics, and collaboration tools;
  • deliver customer support and technical maintenance; and
  • improve security, quality, and performance of the Service.

The categories of Data Subjects include candidates, hiring managers, recruiters, and other platform users. Personal Data processed may include identification data, employment history, skills, contact details, communications, and application metadata.

4. Controller responsibilities

Controller is responsible for:

  • ensuring a lawful basis for Processing and communicating relevant information to Data Subjects;
  • configuring the Service to meet its compliance obligations;
  • obtaining necessary consents before uploading third-party Personal Data; and
  • maintaining accurate and up-to-date records of Processing activities.

5. Processor commitments

Processor will:

  • process Personal Data only on documented instructions from Controller, including with respect to transfers to a third country;
  • ensure persons authorised to process the Personal Data are bound by confidentiality obligations;
  • implement appropriate technical and organisational security measures consistent with Article 32 GDPR;
  • assist Controller with fulfilling requests from Data Subjects and conducting data protection impact assessments to the extent required;
  • notify Controller without undue delay after becoming aware of a Personal Data breach; and
  • make available information necessary to demonstrate compliance and allow for audits conducted by Controller or an appointed auditor, subject to reasonable notice and confidentiality requirements.

6. Sub-processors

Processor maintains an up-to-date list of Sub-processors at https://workdune.com/legal/subprocessors. Processor will:

  1. impose data protection obligations on Sub-processors that are at least equivalent to this Agreement; and
  2. remain fully liable for the performance of Sub-processors.

Processor will provide Controller with prior notice of any intended changes concerning the addition or replacement of Sub-processors, giving Controller the opportunity to object on reasonable grounds.

7. International transfers

Processor will ensure that any transfer of Personal Data outside the European Economic Area is subject to appropriate safeguards, including the use of Standard Contractual Clauses or other mechanisms approved under GDPR.

8. Data subject requests

Taking into account the nature of the Processing, Processor shall assist Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of Controller's obligation to respond to requests for exercising Data Subject rights.

9. Return or deletion of data

Upon termination of the Service, Processor will delete or return all Personal Data in its possession, at Controller's choice, unless Union or Member State law requires storage of the Personal Data.

10. Contact

Questions regarding this Agreement can be directed to Workdune through the platform's support channels.