Data Processing Agreement

We process personal data only to provide the Service to the Customer, for as long as the agreement is in force and until the data has been deleted or returned as set out below.

Storing, organising, searching, displaying, matching, transmitting (such as sending emails the Customer triggers), backing up and deleting data, so that the Customer can manage consultants, candidates, clients, assignments and contracts.

• Data subjects: the Customer's users and employees; consultants and candidates; contact persons at the Customer's clients and partners.
• Personal data: names and contact details; CVs, skills, experience, education and languages; availability, rates and contract terms; notes, messages and calendar entries; documents the Customer uploads.
• Sensitive data: the Service is not designed for special categories of personal data (GDPR art. 9) or national ID numbers. The Customer should not store them unless that is necessary and lawful.

We will:

• process the data only on the Customer's documented instructions; these terms and the Customer's use of the Service are those instructions. If we believe an instruction breaks the law, we tell the Customer;
• make sure everyone with access to the data is bound by confidentiality;
• take the technical and organisational security measures described on our Security page (GDPR art. 32);
• help the Customer, as far as reasonably possible, to respond to data subjects exercising their rights, and with impact assessments and prior consultations;
• notify the Customer without undue delay, and no later than 48 hours, after we become aware of a personal data breach affecting Customer Data, with the information the Customer needs to meet its own obligations;
• make available the information needed to show that we comply with this DPA, and allow audits as described in section 7.

The Customer gives general authorisation for us to use the following sub-processors:

• Microsoft Ireland Operations Ltd (Microsoft Azure) – hosting, database, file storage and reading uploaded CVs with Azure OpenAI, Sweden Central region.
• STRATO GmbH, Germany – sending email.
• Stripe Payments Europe Ltd, Ireland – payments (billing contact data only).

We impose the same data protection obligations on each sub-processor and remain responsible for them. We announce new or replaced sub-processors by email to the account owner at least 30 days in advance; the Customer may object on reasonable grounds, and if we cannot address the objection, the Customer may end the agreement.

Customer Data is stored in Sweden. If a sub-processor can access data from outside the EU/EEA, the transfer is protected by the EU–US Data Privacy Framework or the EU Commission's standard contractual clauses, with additional safeguards where needed.

On request, once a year, we answer the Customer's reasonable written questions about our data protection. If that is not enough, the Customer may carry out an audit, at its own cost, with 30 days' notice, by an auditor bound by confidentiality, in a way that does not disrupt the Service or reveal other customers' data.

The Customer can delete data in the Service at any time. When the agreement ends, the Customer has 30 days to ask for an export of its data in a common machine-readable format. After that period we delete Customer Data from the Service, and backups are overwritten within a further 14 days, unless the law requires us to keep it.

Liability under this DPA follows the limits in the Terms of Service, unless the GDPR says otherwise. If this DPA and the Terms of Service conflict on the processing of personal data, this DPA applies.