DATA PROCESSING ADDENDUM

THE UNDERSIGNED:

 

VONQ and Partner, hereinafter being collectively referred to as “Parties” and individually also as “Party”;

 

WHEREAS:

 

1. VONQ is the expert in smart recruitment marketing. With the use of rich recruitment data, innovative tools and recruitment marketing knowledge, VONQ helps companies to recruit more effectively and efficiently; 
2. Partner is an entity that has an interest in utilizing the technologies developed by VONQ; 
3. Partner will assign to VONQ the Processing of Personal Data for Services provided (hereinafter the “Assignment”). The Assignment defines the object / scope of the data processing to be provided by VONQ and is stipulated in the DPA together with any relevant Addendums or Annexes;
4. Partner will, by executing the Assignment, provide, directly or indirectly, data to VONQ that might be privacy-sensitive and be qualified as Personal Data as referred to in the Data Protection Laws and Regulations;
5. Parties therefore wish to reflect the Parties’ agreement regarding the Processing of Personal Data in compliance with the relevant Data Protection Laws and Regulations;

HAVE AGREED AS FOLLOWS: 

 

1. Interpretation
   1. Unless otherwise defined, capitalized terms, singular or plural, used in this DPA shall have the meaning as set out below: 

 

2. “Controller“, “Data Subject“, “Personal Data“, “Personal Data Breach“, “Processing“ and “Processor“ all have the meanings given to them under the GDPR.
3. This DPA is incorporated and forms an integral part of the Agreement, shall be effective and replace any previously applicable data processing and security terms as of the Effective Date. Regarding the Processing of Personal Data the provisions of this DPA supersedes the Agreement and all previous understandings and agreements between the Parties.
4. In the event of any conflict or inconsistencies between the Agreement, the DPA and/or the SCC, the following order of precedence shall apply (from highest priority to lowest):
   1. SCC’s where applicable;
   2. this DPA and any exhibits or annexes hereto;
   3. the remaining provisions of the Agreement and;
   4. any other document agreed to between the Parties in writing.

 

2. Subject Matter
   1. The subject matter of this DPA concerns the Processing of Personal Data to allow the performance of the Assignment. Any subsequent contract(s) for a new Assignment of additional Services shall be bound by this DPA.
   2. Any Processing of Personal Data as described in Exhibit B to this DPA shall be subject to this DPA.
   3. Partner Affiliates shall be, through Partner, beneficiaries under this DPA and able to exercise all rights pertaining to their Partner Personal Data provided by the respective Partner Affiliate. Partner acts as the single point of contact for all communication, notices or requests by Data Subjects and warrants that it is duly mandated by any Partner Affiliate.

 

3. Scope of Contractual Clauses
   1. If Partner Personal Data is provided by a Partner or Partner Affiliate whose registered office is located within the European Union, provisions of Annex I of Exhibit A shall apply.
   2. Together with section 3.1. Annex II of Exhibit A shall apply if Partner Personal Data is provided by a Partner or Partner Affiliate whose registered office is located in the UK.
   3. Together with section 3.1. Annex III of Exhibit A shall apply if Partner Personal Data is provided by a Partner or Partner Affiliate whose registered office is located in Switzerland.
   4. If Partner Personal Data is provided by a Partner or Partner Affiliate whose registered office is not located within the European Union and is not recognized by the European Commission as providing adequate protection, provisions of Annex IV of Exhibit A shall apply.

 

4. Controller Processor Relationship
   1. Partner is obligated to inform VONQ whether it acts as Controller or Processor of Partner Personal Data.
   2. In case Partner acts as Controller, Parties hereby determine VONQ to be the Processor for the Processing of Partner Personal Data to perform the Assignment.
   3. In case Partners Affiliate acts as Controller, Parties hereby determine Partner to be the Processor and VONQ the sub-processor for the Processing of Partner Personal Data to perform the Assignment.
   4. VONQ shall process Partner Personal Data only on behalf of, under the responsibility of and in accordance with documented instructions from the Controller, communicated by the Partner. The Assignment constitutes such documented initial instructions. The Controller may provide further instructions during the performance of the Assignment, Partner shall act as single point of contact.

 

5. Specification of Processing
   1. Processing of Personal Data by VONQ on behalf of the Partner or Partners Affiliates comprises the performance of the Assignment. As stated in the Assignment, Partner entered into an Agreement with VONQ including the use of VONQ’s Services, as specified in the Agreement.
   2. Data Subjects, data types and the purpose of Processing by VONQ and VONQ’s Services are described in Exhibit B.
   3. Partner or Partners Affiliate shall have sole responsibility for the accuracy, quality and legality of Partner Personal Data and the means by which Partner or Partners Affiliate acquires and acquired such data, unless this DPA determines obligations for VONQ in relation to such accuracy, quality and legality. In addition thereto, Partner or Partners Affiliate have the sole responsibility for ensuring that Partner Personal Data is collected in accordance with the requirements of the respective contractual clauses referenced in section 3 of this DPA.

 

6. Confidentiality
   1. Parties hereby oblige to the confidentiality of Partner Personal Data as transferred under this DPA, save for the situations that any obligation of notification of disclosure flows from applicable law or regulation and save for the transfer of Partner Personal Data that takes place after assignment thereto by Partner or Partners Affiliates.
   2. Parties hereby both ensure that persons authorised to Process Partner Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

 

7. Duration
   1. This DPA enters into effect upon signature by both Parties, is valid for the duration of the Agreement, extends and terminates with the Agreement. The term of this DPA shall correspond to the term of the Agreement. The duration of the Processing equals the duration of this DPA.
   2. When VONQ possesses, after the termination of the Assignment, any Partner Personal Data, this Personal Data shall be deleted, or – such at the discretion of Partner – be returned to Partner, whereby VONQ shall delete existing copies, the foregoing save for the situation wherein VONQ is obliged to keep the Personal Data on the basis of applicable laws or regulations of the European Union or its members.
   3. Article 6 (Confidentiality) and article 8 (Miscellaneous) will survive for an unlimited period of time after termination or rescission, no matter the grounds of this termination or rescission, of this DPA. 

 

8. Miscellaneous
   1. This DPA may be altered or supplemented only in writing and provided any such amendment is signed by the duly authorized representatives of both Parties.
   2. If any provision of this DPA is held invalid, illegal, or unenforceable for any reason, such provision shall be severed and the remainder of the provisions hereof shall continue in full force and effect as if this DPA has been executed with the invalid provision eliminated.
   3. This DPA is exclusively governed by the laws of the jurisdiction set forth in Annex IV of Exhibit A section 2.3.
   4. Any disputes that may arise between parties, shall be brought before the court set forth in Annex IV of Exhibit A section 2.4.

Exhibit A

Annex I of Exhibit A - Data Processor Clauses

1. Data Processor Clauses

Data Processor Clauses form an integral part of this DPA, are hereby incorporated by reference and shall apply as published in the Official Journal of the European Union, as may be amended, superseded, or replaced, and will be deemed completed with the information set out in this Annex I of Exhibit A.

 

2. Applicable Data Processor Clauses
   1. Clause 5: Not applicable.
   2. Clause 7.7: Option 2.
      1. As for Clause 7.7 the following shall apply:
      2. Partner hereby provides its specific written authorisation to VONQ to engage the Sub-Processors for the purpose of performing the Assignment and this DPA. The current list of Sub-Processors engaged in Processing Partner Personal Data can be found on VONQ’s webpage at: https://www.vonq.com/privacy-center-list-of-subprocessors/
      3. In case VONQ engages another Processor for carrying out specific Processing activities on behalf of Partner, the data protection obligations within this DPA, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the Processing will meet the requirements of the GDPR, shall apply to such Sub-Processor.
      4. VONQ shall inform Partner about any new Sub-Processor a minimum of 30 days in advance via email to the “Notification” email provided on the cover page of this DPA.
         1. Partner has the right to object to the addition of a new Sub-Processor, for a justified reason within 30 days of receipt of VONQ’s notification, via email to dpo@vonq.com. In such case, Partner shall give VONQ a reasonable time to find a replacing Sub-Processor. If VONQ is unable to find a replacing Sub-Processor (within 60 days) and the use of this specific Sub-Processor cannot be discontinued, Partner shall have the right to terminate the Agreement by written notice before the effective date of the change.
         2. Should the Partner not object to the addition of a new Sub-Processor within 30 days following the notification, the consent of the Partner shall be deemed to have been given.
   3. Option 1 shall apply for Clause 1, Clause 8 lit. (c) (4), Clause 9.1 lit. (b) and (c) and Clause 9.2 lit. (c) of the Data Processor Clauses.
   4. Annex I: Information about the Parties shall be found on the cover page of the Agreement and is hereby incorporated.
   5. Annex II: Description of the transfer, Data Subjects, data types and purpose of Processing is described in Exhibit B and is hereby incorporated. The frequency of the transfer is on a continuous basis for the duration of the Agreement.
   6. Annex III: Technical and organisational measures are described in Exhibit C and are hereby incorporated.

Annex II of Exhibit A – UK Clauses

 

1. UK Clauses

The Parties agree that the UK Addendum (Data Protection Act 2018, section 119A) is hereby incorporated by reference and shall apply to UK transfers as set out in Annex II of Exhibit A, together with the Standard Contractual Clauses as set forth in Annex IV of Exhibit A.

 

2. Applicable UK Clauses

Tables of the UK Addendum shall be completed as follows:

1. Table 1 (Parties): As stipulated on the cover page of this DPA.
2. Table 2 (Selected SCCs, Modules and Selected Clauses): As stipulated in Annex I of Exhibit A.
3. Table 3 (Appendix Information): Annex 1A: As stipulated in Annex I of Exhibit A to this DPA.
4. Table 4 (Ending this Addendum when the Approved Addendum Changes): Neither Party may end the UK Addendum incorporated herein in the manner set out in section 19 thereto.
5. The Alternative Part 2 Mandatory Clauses of the UK Addendum shall apply, as follows:
6. Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the Information Commission Office (ICO) and laid before the UK Parliament in accordance with section 119A of the Data Protection Act 2018 on 28 January 2022, as it is revised under Section 18 of those mandatory clauses.

Annex III of Exhibit A - Swiss Clauses

 

1. Swiss Clauses

The Parties agree that the Standard Contractual Clauses as detailed in Annex IV of Exhibit A shall be adjusted as set out below where the FADP applies to Swiss transfers:

 

2. Applicable Standard Contractual Clauses
   1. References to the Standard Contractual Clauses mean the Standard Contractual Clauses as amended by this Annex III of Exhibit A;
   2. The Swiss Federal Data Protection and Information Commissioner shall be the sole Supervisory Authority for Swiss transfers exclusively subject to the FADP;
   3. The terms “General Data Protection Regulation”, GDPR or “Regulation (EU) 2016/679” as utilized in the Standard Contractual Clauses shall be interpreted to include the FADP with respect to Swiss transfers;
   4. References to “Regulation (EU) 2018/1725” are removed;
   5. Swiss transfers subject to both the FADP and the GDPR shall be dealt with by the EU Supervisory Authority named in Annex IV of Exhibit A;
   6. References to the “Union”, “EU” and “EU Member State” shall not be interpreted in such a way as to exclude Data Subjects in Switzerland from the possibility of exercising their rights in their place of habitual residence (Switzerland) in accordance with clause 18(c) of the Standard Contractual Clauses;
   7. Where Swiss transfers are exclusively subject to the FADP, all references to the GDPR in the Standard Contractual Clauses are to be understood to be references to the FADP;

Where Swiss transfers are subject to both the FDPA and the GDPR, all references to the GDPR in the Standard Contractual Clauses are to be understood to be references to the FDPA insofar as the Swiss transfer is subject to the FADP.

Annex IV of Exhibit A - Standard Contractual Clauses

 

1. Standard Contractual Clauses

Standard Contractual Clauses form an integral part of this DPA, are hereby incorporated by reference and shall apply as published in the Official Journal of the European Union, as may be amended, superseded, or replaced, and will be deemed completed with the information set out in this Annex IV of Exhibit A.

 

2. Applicable Standard Contractual Clauses
   1. Clause 7: Not applicable 
   2. Clause 11 (a): Not applicable.
   3. Clause 17: Laws of the Netherlands
   4. Clause 18: Rotterdam, the Netherlands
   5. Annex I.A. (List of Parties): Information about the Parties shall be found on the cover page of this DPA.
   6. Annex I.B. (Description of the transfer): Data Subjects, data types and purpose of Processing is described in Exhibit B and hereby incorporated.

Exhibit B

 

Specification of Processing – Hiring API (HAPI)

 

1. General

Services based on the Hiring API are HAPI Job Marketing (hereinafter “HAPI JM”) and HAPI Job Post (hereinafter “HAPI JP”). Both products, HAPI JM and HAPI JP, can be extended with the HAPI Payments.

 

2. Data Subjects, Data Types and Purpose of Processing
   1. HAPI Services

To fulfil the Assignment all HAPI Services process the following Personal Data: Users with valid credentials to HAPI (API Key(s)) are subscribers of HAPI (hereinafter “HAPI-Subscriber(s)”). VONQ processes HAPI-Subscriber IP-addresses for HAPI security, auditability and optimization. VONQ also processes recruiter information if provided by Partner or Partner Affiliates as part of Vacancy Data.

 

2. HAPI JM

To fulfil the Assignment and in addition to 2.1. VONQ processes Personal Data, such as Partners or Partners Affiliates recruiter information (ID, first name, last name and business email address). Data types and Data Subjects are further detailed in subsection 2.5.1.

 

3. HAPI JP

To fulfil the Assignment and in addition to 2.1. and 2.2. VONQ processes Personal Data, such as Partners or Partners Affiliates job board credentials, username and password, for the contract(s) the Partner provides. Data types and Data Subjects are further detailed in subsection 2.5.2.

 

4. HAPI Payment Module

The HAPI Payment Module can be added to HAPI JM and/or HAPI JP. To fulfil the Assignment and in addition to the Personal Data mentioned in sections 2.2. and/or 2.3. VONQ processes Personal Data, such as the Partners or Partners Affiliates billing details (name, first name, phone number, business email address, tax ID, billing address, ID). Data types and Data Subjects are further detailed in subsection 2.5.3.

 

5. Data Types and Data Subjects – HAPI - Complete Overview
   1. HAPI JM – Overview

 

 

2. HAPI JP – Overview

 

 

3. HAPI Payment Module - Overview

 

 

Exhibit C

 

Technical and Organisational Measures

 

VONQ ensures for its area of responsibility the implementation of and abidance by technical and organizational measures agreed upon, according to this annex. The Partner will implement appropriate technical and organisational measures according to the requirements of the GDPR.

 

1. Confidentiality (article 32 sec. 1 subs. (b) GDPR)

Access control to premises and facilities (physical access control)

Objective: Unauthorised access to premises and facilities must be prevented.

 

System access control (hardware access control

Objective: No access to data processing systems by unauthorized persons.

 

Access control to data (software access control)

Objective: Unauthorised activities in data processing systems outside of assigned authorisations must be prevented.

 

Separation Control

Objective: Data collected for different purposes must be processed separately

 

2. Integrity, availability and resilience of systems (article 32 sec. 1 subs. (b) GDPR)

Transfer control

Objective: Protection of PII from unauthorized reading, modification or deletion.

 

Input control

Objective: Traceability of entries; modification or deletion of data.

 

3. Availability and access (article 32 sec. 1 subs. (c) GDPR)

Objective: Data loss prevention and recovery in a timely manner.

 

4. Procedures for regular testing, assessing, and evaluating (article 32 sec. 1 subs. (d) GDPR)

Control Procedures

Objective: Procedures have to be implemented to ensure regular testing, assessment and evaluation of the effectiveness of the data security measures.

 

Control of Instructions

Objective: Data shall only be processed by service providers, such as subcontractors, in accordance with the instructions of VONQ.

 

5. Pseudonymisation and encryption (article 32 sec. 1 subs. (a) GDPR) 

Objective: PII shall be collected, processed and retained encrypted and in a pseudonymous way.