Data Processing Agreement (DPA) for SmartDistribute 2.0 (HAPI Job Post)

Version: April 1st, 2026

Effective Upon Acceptance | Applicable to HAPI JP Orders via SmartDistribute 2.0

This Data Processing Agreement, and respective Exhibits, ("Agreement") forms the contractual arrangement between the end-customers of SAP and VONQ (together, the “Parties”) for the Processing of Personal Data following the purchase and use of HAPI JP available via SmartDistribute 2.0. 

By submitting an order for HAPI JP, the end-customer agrees to the terms of this Agreement, which governs the processing of personal data. Alternatively, end-customer may reach out to dpo@vonq.com and celebrate a signed version of this Agreement.

VONQ and end-customer, hereinafter being collectively referred to as “Parties” and individually also as “Party”;

WHEREAS:

1. VONQ is the expert in smart recruitment marketing. With the use of rich recruitment data, innovative tools and recruitment marketing knowledge, VONQ helps companies to recruit more effectively and efficiently; 

2. Partner is an entity that has an interest in making the technologies developed by VONQ available to its end-customers; 

3. End-customer will assign to VONQ the Processing of Personal Data for Services provided (hereinafter the “Assignment”). The Assignment defines the object / scope of the data processing to be provided by VONQ and is stipulated in the DPA together with any relevant Addendums or Annexes;

4. End-customer will, by executing the Assignment, provide, directly or indirectly, data to VONQ that might be privacy-sensitive and be qualified as Personal Data as referred to in the Data Protection Laws and Regulations;

5. Parties therefore wish to reflect the Parties’ agreement regarding the Processing of Personal Data in compliance with the relevant Data Protection Laws and Regulations;

HAVE AGREED AS FOLLOWS: 

1. Interpretation

   1. Unless otherwise defined, capitalized terms, singular or plural, used in this DPA shall have the meaning as set out below: 

2. “Controller“, “Data Subject“, “Personal Data“, “Personal Data Breach“, “Processing“ and “Processor“ all have the meanings given to them under the GDPR.

3. This DPA is incorporated and forms an integral part of the Agreement, shall be effective and replace any previously applicable data processing and security terms as of the Effective Date. Regarding the Processing of Personal Data the provisions of this DPA supersedes the Agreement and all previous understandings and agreements between the Parties.

4. In the event of any conflict or inconsistencies between the Agreement, the DPA and/or the SCC, the following order of precedence shall apply (from highest priority to lowest):

   1. SCC’s where applicable;

   2. this DPA and any exhibits or annexes hereto;

   3. the remaining provisions of the Agreement and;

   4. any other document agreed to between the Parties in writing

2. Subject Matter

   1. The subject matter of this DPA concerns the Processing of Personal Data to allow the performance of the Assignment. Any subsequent contract(s) for a new Assignment of additional Services shall be bound by this DPA.

   2. Any Processing of Personal Data as described in Exhibit B to this DPA shall be subject to this DPA.

3. Scope of Contractual Clauses

   1. If Personal Data is provided by an end-customer whose registered office is located within the European Union, provisions of Annex I of Exhibit A shall apply.

   2. Together with section 3.1. Annex II of Exhibit A shall apply if Personal Data is provided by an end-customer whose registered office is located in the UK.

   3. Together with section 3.1. Annex III of Exhibit A shall apply if Personal Data is provided by an end-customer whose registered office is located in Switzerland.

   4. If Personal Data is provided by an end-customer whose registered office is not located within the European Union and is not recognized by the European Commission as providing adequate protection, provisions of Annex IV of Exhibit A shall apply.

4. Controller Processor Relationship

   1. Parties hereby determine VONQ to be the Processor for the Processing of Personal Data to perform the Assignment and end-customer to be the Controller.

   2. VONQ shall process Personal Data only on behalf of, under the responsibility of and in accordance with documented instructions from the Controller. The Assignment constitutes such documented initial instructions. The Controller may provide further instructions during the performance of the Assignment.

5. Specification of Processing

   1. Processing of Personal Data by VONQ on behalf of the end-customer comprises the performance of the Assignment. As stated in the Assignment, end-customer entered into an Agreement with VONQ including the use of VONQ’s Services, as specified in the Agreement.

   2. Data Subjects, data types and the purpose of Processing by VONQ and VONQ’s Services are described respectively in Exhibit B:

   3. End-customer shall have sole responsibility for the accuracy, quality and legality of Personal Data and the means by which end-customer acquires and acquired such data, unless this DPA determines obligations for VONQ in relation to such accuracy, quality and legality. In addition, end-customer has the sole responsibility for ensuring that Personal Data is collected in accordance with the requirements of the respective contractual clauses referenced in section 3 of this DPA.

6. SmartFill

   1. The Parties acknowledge and agree that, for purposes of the EU Artificial Intelligence Act (Regulation (EU) 2024/1684): 

      1. VONQ acts as the Provider of the AI System; 

      2. End-customer acts as the Deployer of the AI system; and

      3. Microsoft Azure OpenAI acts as a third-party service provider, providing computing and model-hosting services.

   2. VONQ warrants that its AI Systems are developed and operated in compliance with the EU AI Act.

   3. Processing occurs within a private, enterprise-grade tenant of Azure OpenAI, isolated from public consumer models.

   4. VONQ shall restrict the data shared with SmartFill to only those fields strictly necessary for form completion (e.g., Job Title, Job Description, Job Description, Location). 

   5. VONQ contractually prohibits the use of end-customer Personal Data for the training, fine-tuning, or improvement of any LLM (Large Language Model) provided by Microsoft or used by VONQ.

   6. The processing of end-customer Personal Data via SmartFill is limited to transient inference. VONQ warrants that data is processed in-memory and does not persist in any database or log file at VONQ or Microsoft after the specific form-fill transaction is complete.

7. Confidentiality

   1. Parties hereby oblige to the confidentiality of Personal Data as transferred under this DPA, save for the situations that any obligation of notification of disclosure flows from applicable law or regulation and save for the transfer of Personal Data that takes place after assignment thereto by end-customer.

   2. Parties hereby both ensure that persons authorised to Process end-customer  Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

8. Duration

   1. This DPA enters into effect upon signature by both Parties, is valid for the duration of the Agreement, extends and terminates with the Agreement. The term of this DPA shall correspond to the term of the Agreement. The duration of the Processing equals the duration of this DPA.

   2. When VONQ possesses, after the termination of the Assignment, any end-customer Personal Data, this Personal Data shall be deleted, or – such at the discretion of end-customer – be returned, whereby VONQ shall delete existing copies, the foregoing save for the situation wherein VONQ is obliged to keep the Personal Data on the basis of applicable laws or regulations of the European Union or its members.

   3. Article 7 (Confidentiality) and article 9 (Miscellaneous) will survive for an unlimited period of time after termination or rescission, no matter the grounds of this termination or rescission, of this DPA. 

9. Miscellaneous

   1. This DPA may be altered or supplemented only in writing and provided any such amendment is signed by the duly authorized representatives of both Parties.

   2. If any provision of this DPA is held invalid, illegal, or unenforceable for any reason, such provision shall be severed and the remainder of the provisions hereof shall continue in full force and effect as if this DPA has been executed with the invalid provision eliminated.

   3. This DPA is exclusively governed by the laws of the jurisdiction set forth in Annex IV of Exhibit A section 2.3.

   4. Any disputes that may arise between parties, shall be brought before the court set forth in Annex IV of Exhibit A section 2.4.

Exhibit A

 

Annex I of Exhibit A - Data Processor Clauses

 

1. Data Processor Clauses

Data Processor Clauses form an integral part of this DPA, are hereby incorporated by reference and shall apply as published in the Official Journal of the European Union, as may be amended, superseded, or replaced, and will be deemed completed with the information set out in this Annex I of Exhibit A.

2. Applicable Data Processor Clauses

   1. Clause 5: Not applicable.

   2. Clause 7.7: Option 2.

      1. As for Clause 7.7 the following shall apply:

      2. End-customer hereby provides its specific written authorisation to VONQ to engage the Sub-Processors for the purpose of performing the Assignment and this DPA. The current list of Sub-Processors engaged in Processing Personal Data can be found on VONQ’s webpage at: https://www.vonq.com/privacy-center-list-of-subprocessors/

      3. In case VONQ engages another Processor for carrying out specific Processing activities on behalf of end-customer, the data protection obligations within this DPA, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the Processing will meet the requirements of the GDPR, shall apply to such Sub-Processor.

      4. VONQ shall inform end-customer about any new Sub-Processor a minimum of 30 days in advance via email to the “Notification” email provided on the cover page of this DPA.

         1. End-customer has the right to object to the addition of a new Sub-Processor, for a justified reason within 30 days of receipt of VONQ’s notification, via email to dpo@vonq.com. In such case, end-customer shall give VONQ a reasonable time to find a replacing Sub-Processor. If VONQ is unable to find a replacing Sub-Processor (within 60 days) and the use of this specific Sub-Processor cannot be discontinued, end-customer shall have the right to terminate the Agreement by written notice before the effective date of the change.

         2. Should the end-customer not object to the addition of a new Sub-Processor within 30 days following the notification, the consent of the end-customer shall be deemed to have been given.

   3. Option 1 shall apply for Clause 1, Clause 8 lit. (c) (4), Clause 9.1 lit. (b) and (c) and Clause 9.2 lit. (c) of the Data Processor Clauses.

   4. Annex I: Information about the Parties shall be found on the cover page of this DPA and is hereby incorporated.

   5. Annex II: Description of the transfer, Data Subjects, data types and purpose of Processing is described in Exhibit B and is hereby incorporated. The frequency of the transfer is on a continuous basis for the duration of the Agreement.

   6. Annex III: Technical and organisational measures are described in Exhibit C and are hereby incorporated.

Annex II of Exhibit A – UK Clauses

1. UK Clauses

The Parties agree that the UK Addendum (Data Protection Act 2018, section 119A) is hereby incorporated by reference and shall apply to UK transfers as set out in Annex II of Exhibit A, together with the Standard Contractual Clauses as set forth in Annex IV of Exhibit A.

2. Applicable UK Clauses

Tables of the UK Addendum shall be completed as follows:

1. Table 1 (Parties): As stipulated on the cover page of this DPA.

2. Table 2 (Selected SCCs, Modules and Selected Clauses): As stipulated in Annex I of Exhibit A.

3. Table 3 (Appendix Information): Annex 1A: As stipulated in Annex I of Exhibit A to this DPA.

4. Table 4 (Ending this Addendum when the Approved Addendum Changes): Neither Party may end the UK Addendum incorporated herein in the manner set out in section 19 thereto.

5. The Alternative Part 2 Mandatory Clauses of the UK Addendum shall apply, as follows:

6. Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the Information Commission Office (ICO) and laid before the UK Parliament in accordance with section 119A of the Data Protection Act 2018 on 28 January 2022, as it is revised under Section 18 of those mandatory clauses.

Annex III of Exhibit A - Swiss Clauses

1. Swiss Clauses

The Parties agree that the Standard Contractual Clauses as detailed in Annex IV of Exhibit A shall be adjusted as set out below where the FADP applies to Swiss transfers:

2. Applicable Standard Contractual Clauses

   1. References to the Standard Contractual Clauses mean the Standard Contractual Clauses as amended by this Annex III of Exhibit A;

   2. The Swiss Federal Data Protection and Information Commissioner shall be the sole Supervisory Authority for Swiss transfers exclusively subject to the FADP;

   3. The terms “General Data Protection Regulation”, GDPR or “Regulation (EU) 2016/679” as utilized in the Standard Contractual Clauses shall be interpreted to include the FADP with respect to Swiss transfers;

   4. References to “Regulation (EU) 2018/1725” are removed;

   5. Swiss transfers subject to both the FADP and the GDPR shall be dealt with by the EU Supervisory Authority named in Annex IV of Exhibit A;

   6. References to the “Union”, “EU” and “EU Member State” shall not be interpreted in such a way as to exclude Data Subjects in Switzerland from the possibility of exercising their rights in their place of habitual residence (Switzerland) in accordance with clause 18(c) of the Standard Contractual Clauses;

   7. Where Swiss transfers are exclusively subject to the FADP, all references to the GDPR in the Standard Contractual Clauses are to be understood to be references to the FADP;

Where Swiss transfers are subject to both the FDPA and the GDPR, all references to the GDPR in the Standard Contractual Clauses are to be understood to be references to the FDPA insofar as the Swiss transfer is subject to the FADP.

Annex IV of Exhibit A - Standard Contractual Clauses

1. Standard Contractual Clauses

Standard Contractual Clauses form an integral part of this DPA, are hereby incorporated by reference and shall apply as published in the Official Journal of the European Union, as may be amended, superseded, or replaced, and will be deemed completed with the information set out in this Annex IV of Exhibit A.

2. Applicable Standard Contractual Clauses
   1. Clause 7: Not applicable 
   2. Clause 11 (a): Not applicable.
   3. Clause 17: Laws of the Netherlands
   4. Clause 18: Rotterdam, the Netherlands
   5. Annex I.A. (List of Parties): Information about the Parties shall be found on the cover page of this DPA.
   6. Annex I.B. (Description of the transfer): Data Subjects, data types and purpose of Processing is described in Exhibit B and hereby incorporated.

Exhibit B

Specification of Processing – Hiring API (HAPI)

1. Data Subjects, Data Types and Purpose of Processing

   1. HAPI Services

To fulfil the Assignment, HAPI Services process user credentials for authentication purposes. HAPI authentication is either performed through a unique secret key-based method or through a JWT-based token. 

Additionally, VONQ processes HAPI-Subscriber IP-addresses for HAPI security, auditability and optimization.

2. HAPI JP

In addition to 1.1., VONQ processes end-customer job board credentials such as username and password, to post vacancies with end-customer’s established posting contracts, 

In order to create a campaign, VONQ processes recruiter info. Recruiter is the user creating the campaign and end-customer may want to use this to provide filtering by recruiter for groups sharing an account. For this purpose, VONQ processes the recruiter's name. Additionally, and optionally, end-customers may provide the recruiter’s e-mail address and ID. 

As part of posting details, VONQ may process contact information. Contact is who to contact about the job. This may be part of the posting info so candidates know who they can reach out to in order to learn more about the vacancy. For this purpose, VONQ may process the recruiter’s name, phone number and e-mail address.

3. Direct Apply

HAPI Direct Apply can be integrated with HAPI JP provided the selected job boards support it and the end-customer’s ATS provisions for it.

In addition to 1.2, VONQ processes personal data such as such as salutation, name, phone number, email address, home address, resume/CV and other Personal Data of and provided by (potential) candidates.

4. HAPI SmartFill

SmartFill is integrated with HAPI JP and leverages on Microsoft Azure’s OpenAI to interact with the customer’s ATS and to map its data to the required fields for specific job boards (e.g., remote/on-site, full-time/part-time). As a minimum, a name is required to be able to offer a standardized check out experience for all 5000+ channels we offer, and to enable fast campaign delivery. At end-customer’s discretion, job descriptions may also include contact information (such as name, e-mail and phone number). Data processed for this purpose is session specific and is not used to train or otherwise improve Microsoft Azure’s OpenAI models.

5. HAPI Payment Module

The HAPI Payment Module can be added to HAPI JP. To fulfil the Assignment and in addition to the Personal Data mentioned in sections 2.2. and/or 2.3. VONQ processes Personal Data, such as the end-customer’s billing details (name, first name, phone number, business email address, tax ID, billing address, ID). 

6. Data Types and Data Subjects – HAPI - Complete Overview

   1. HAPI JP – Overview

1. HAPI Direct Apply – Overview

2. HAPI SmartFill

3. HAPI Payment Module - Overview

2. Duration of processing

VONQ stores logs of Recruiter info and Contact info for the duration of the commercial relationship after which personal data is purged or, at end-customer’s discretion, returned and copies purged.

Where Direct Apply is enabled, VONQ stores candidate data for up to 30 days or until the transfer to end-customer’s ATS is successful, whichever comes first, after which records are automatically purged.

Where SmartFill is enabled, VONQ does not store logs, responses, or any other data related to this purpose of auto filling job board forms, discarding it once the form is completed, nor does VONQ use end-customer Data to train or finetune the AI model.

3. Location of Processing

VONQ will ensure that all processing and storage of personal data will take place within the EEA.

Exhibit C

Technical and Organisational Measures

VONQ ensures for its area of responsibility the implementation of and abidance by technical and organizational measures agreed upon, according to this annex. The end-customer will implement appropriate technical and organisational measures according to the requirements of the GDPR.

1. Confidentiality (article 32 sec. 1 subs. (b) GDPR)

Access control to premises and facilities (physical access control)

Objective: Unauthorised access to premises and facilities must be prevented.

System access control (hardware access control

Objective: No access to data processing systems by unauthorized persons.

Access control to data (software access control)

Objective: Unauthorised activities in data processing systems outside of assigned authorisations must be prevented.

Separation Control

Objective: Data collected for different purposes must be processed separately

2. Integrity, availability and resilience of systems (article 32 sec. 1 subs. (b) GDPR)

Transfer control

Objective: Protection of PII from unauthorized reading, modification or deletion.

Input control

Objective: Traceability of entries; modification or deletion of data.

3. Availability and access (article 32 sec. 1 subs. (c) GDPR)

Objective: Data loss prevention and recovery in a timely manner.

4. Procedures for regular testing, assessing, and evaluating (article 32 sec. 1 subs. (d) GDPR)

Control Procedures

Objective: Procedures have to be implemented to ensure regular testing, assessment and evaluation of the effectiveness of the data security measures.

Control of Instructions

Objective: Data shall only be processed by service providers, such as subcontractors, in accordance with the instructions of VONQ.

5. Pseudonymisation and encryption (article 32 sec. 1 subs. (a) GDPR) 

Objective: PII shall be collected, processed and retained encrypted and in a pseudonymous way.