Data Processing Agreement (DPA)
under Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)
The Czech version is binding. This English translation is provided for information only; in case of any discrepancy the Czech version prevails.
Parties
Controller: the Customer of the JOBSON service, i.e. a legal entity or a natural person acting as an entrepreneur which has registered for the JOBSON service and has expressed consent to this agreement (the "Controller"),
and
Processor: BePositive Group s.r.o., Company ID (IČO) 05232317, VAT ID (DIČ) CZ05232317, with its registered office at Jičínská 1786/49, Žižkov, 130 00 Prague 3, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, File 260372, acting through its managing director Jakub Dvořák (the "Processor"),
(together the "Parties") conclude this data processing agreement (the "DPA").
Preamble
(A) The Parties have concluded an agreement on the provision of the JOBSON service, which includes the General Terms and Conditions of the JOBSON Service (the "Terms" and, together with all their components, the "Main Agreement").
(B) In providing the JOBSON service (the "Service"), the Processor processes for the Controller personal data entered into the Service by the Controller or its users or, where applicable, entered into the Service by the data subjects themselves on the Controller's instructions (e.g. applicants via a recruitment form or questionnaire).
(C) This DPA is concluded electronically together with the Main Agreement, by active consent at registration for the Service. The Parties regard it as a contract in writing within the meaning of Article 28(9) GDPR (electronic form). The Processor keeps evidence of the consent.
1. Definitions
1.1 The terms "personal data", "processing", "controller", "processor", "data subject", "personal data breach", "special categories of personal data" and others have the meaning given to them in Article 4 GDPR.
1.2 "Controller Personal Data" means personal data processed by the Processor for the Controller within the Service, as described in Annex 1.
1.3 "Sub-processor" means another processor engaged by the Processor in the processing of Controller Personal Data (Article 28(2) and (4) GDPR).
1.4 "Data Protection Legislation" means the GDPR, Act No. 110/2019 Coll., on the Processing of Personal Data, and other applicable regulations of the EU and of the Member States in which the Controller operates.
1.5 Other capitalised terms have the meaning given to them in the Terms.
2. Subject Matter, Nature and Purpose of Processing
2.1 The Processor undertakes to process Controller Personal Data solely for the purpose of providing the Service under the Main Agreement and in accordance with this DPA and the documented instructions of the Controller.
2.2 The subject matter, duration, nature and purpose of the processing, the type of personal data and the categories of data subjects are set out in Annex 1.
2.3 The Controller is responsible for determining the purposes and means of processing of Controller Personal Data. The Processor does not determine the purposes of processing of Controller Personal Data.
3. Duration
3.1 The DPA is concluded for the term of the Main Agreement and, further, for the period during which the Processor processes Controller Personal Data (in particular during the transition period under Article 24 of the Terms and until their deletion under Article 13 of this DPA).
4. Instructions of the Controller
4.1 The Processor processes Controller Personal Data only on the basis of documented instructions of the Controller (Article 28(3)(a) GDPR), including with regard to transfers to third countries, unless required to do so by EU or Member State law; in such a case, the Processor will inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
4.2 The documented instructions of the Controller are: a) the Main Agreement and this DPA; b) settings and actions performed by the Controller and its users in the Service (e.g. entering, importing, editing, exporting, deleting and anonymising data, setting retention periods, launching AI Features, sending messages, filing reports, connecting integrations, issuing API keys and MCP tokens); c) other instructions given by the Controller in writing (by e-mail from the account administrator's address), provided they are consistent with the Main Agreement and technically feasible; the Processor may make instructions beyond the scope of the Service conditional on payment of reasonable costs.
4.3 The Processor will immediately inform the Controller if, in its opinion, an instruction infringes Data Protection Legislation (Article 28(3), last sentence, GDPR). The Processor is entitled to postpone the execution of such an instruction until it is confirmed or changed by the Controller.
4.4 The Processor will not use Controller Personal Data for its own purposes, in particular for marketing, profiling or training artificial intelligence models. The following are also regarded as processing for the purposes of the Service: (i) measuring and billing consumption (numbers of operations, AI Credits, active users), (ii) ensuring security and operation and fixing errors, (iii) creating aggregated anonymous statistics under Article 19.3 of the Terms.
5. Obligations of the Controller
5.1 The Controller is responsible for ensuring that: a) it has a valid legal basis under Article 6 GDPR for the processing of Controller Personal Data and, for special categories of personal data, an exception under Article 9(2) GDPR (in particular point (b) – carrying out obligations in the field of employment and social security law), for data relating to criminal convictions the conditions of Article 10 GDPR, and for birth numbers the conditions of special regulations; b) it has fulfilled the information obligation towards data subjects (Articles 13 and 14 GDPR), including information on the engagement of a processor, on the use of AI Features (in particular the AI recruiter, AI extraction and recommendations) and on transfers outside the EEA, where they take place; c) it has assessed the need for a data protection impact assessment (DPIA) under Article 35 GDPR – given the scope of processing of employee and applicant data, the vulnerability of data subjects, special categories of data and the use of AI, a DPIA is usually necessary; d) it enters into the Service only personal data that are adequate and necessary for the given purpose and sets appropriate retention periods and user permissions; e) it fulfils the obligations of a deployer under Regulation (EU) 2024/1689 (AI Act) to the extent they apply to the use of AI Features (see Article 14 of the Terms); f) where it enters into the Service personal data for which it is itself a processor (e.g. data of its clients), it is authorised to do so by its controller; in such a case the Processor is a further processor.
5.2 The Controller is responsible for decisions to transfer data outside the Service which it carries out itself or which the Service carries out on its instructions (export, API, MCP connection to an AI tool chosen by the Controller, sending an e-mail, SMS or message via a communication channel, reports to authorities). Recipients of such data are not Sub-processors of the Processor (see Article 15.3 of the Terms).
6. Confidentiality and Authorised Persons
6.1 The Processor will ensure that persons authorised to process Controller Personal Data (employees, collaborators) have committed themselves to confidentiality contractually or are under a statutory obligation of confidentiality, including after the end of their relationship with the Processor (Article 28(3)(b) GDPR).
6.2 Access of the Processor's personnel to Controller Personal Data is limited to the necessary minimum and is possible only: a) to provide support at the request or with the consent of the Controller, b) to resolve an incident or a serious defect, c) to comply with a legal obligation.
7. Security of Processing
7.1 The Processor has adopted and maintains technical and organisational measures under Article 32 GDPR, which are described in Annex 2, taking into account the state of the art, the costs, the nature, scope, context and purposes of processing and the risks to the rights and freedoms of data subjects.
7.2 The Processor continuously evaluates and improves the measures; it is entitled to change them provided that this does not reduce the overall level of security.
7.3 The Controller is responsible for security on its side, in particular for the management of user accounts and permissions, the security of passwords, API keys and MCP tokens, and of its devices (including devices used for signing documents).
8. Sub-processors
8.1 The Controller grants the Processor a general written authorisation to engage Sub-processors (Article 28(2) GDPR). The current list of Sub-processors is published at https://jobson.cloud/en/dpa#subprocessors; its version as at the effective date of the DPA constitutes Annex 3.
8.2 The Processor will inform the Controller of any intended change (addition or replacement) of a Sub-processor at least 30 days in advance by e-mail to the account administrator's address or by a notification in the Application. The Controller may object to the change on legitimate grounds relating to data protection within 30 days of the notification. The Parties will try to find a solution; if none is found, the Controller is entitled to terminate the Main Agreement with effect from the date on which the change takes effect, and the Processor will refund the pro rata part of the prepaid price.
8.3 In urgent cases (e.g. a sudden cessation of a Sub-processor's activity or security reasons), the Processor may replace a Sub-processor with shorter notice; the Controller retains the right to object under Article 8.2.
8.4 The Processor will contractually impose on each Sub-processor essentially the same data protection obligations as set out in this DPA, in particular the obligation to provide sufficient guarantees to implement appropriate technical and organisational measures (Article 28(4) GDPR). The Processor is liable to the Controller for the performance of a Sub-processor's obligations as if it performed them itself.
8.5 At the Controller's request, the Processor will provide information on the contractual safeguards with a Sub-processor to the extent that this is not precluded by trade secrets or the Sub-processor's contractual terms (for large providers, usually by reference to their public data processing terms).
9. Transfers to Third Countries
9.1 The Processor processes Controller Personal Data primarily in the European Economic Area (EEA) – the databases, files and backups of the Service are stored with a hosting provider in the EU, and AI processing takes place in the Google Cloud europe-west3 region (Frankfurt am Main).
9.2 Controller Personal Data may be transferred to a third country (outside the EEA) or to an international organisation only: a) to a country for which the European Commission has decided that it ensures an adequate level of protection (Article 45 GDPR), including transfers to recipients certified under the EU–U.S. Data Privacy Framework; or b) on the basis of standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914; or c) on the basis of another appropriate safeguard under Article 46 GDPR.
9.3 The list of Sub-processors states the place of processing and the transfer mechanism for each of them.
9.4 The Controller acknowledges that transfers resulting from its own decisions under Article 5.2 (e.g. connecting an AI tool via MCP, communication channels, sending SMS abroad) are assessed and safeguarded by the Controller itself.
10. Assistance with the Exercise of Data Subject Rights
10.1 Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures in fulfilling its obligation to respond to requests for the exercise of data subject rights (Articles 12–23 GDPR) (Article 28(3)(e) GDPR). For this purpose, the Service provides in particular: display and export of data about a person, rectification, erasure, anonymisation, archiving, recording of consents with purpose and expiry, and the change history of a record.
10.2 If the Processor receives a request from a data subject concerning Controller Personal Data, it will forward it to the Controller without undue delay (if the Controller is identifiable from the request) and will not respond to it on the merits itself, except to state that it has forwarded the request.
10.3 The Processor will provide assistance beyond the functions of the Service at the Controller's request against payment of reasonable costs, unless the assistance is required as a result of a breach of the Processor's obligations.
11. Assistance with Other Obligations of the Controller
11.1 Taking into account the nature of the processing and the information available to it, the Processor assists the Controller in fulfilling its obligations under Articles 32 to 36 GDPR (security, breach notification, DPIA, prior consultation) (Article 28(3)(f) GDPR), in particular by providing a description of the Service, of the technical and organisational measures, the List of Sub-processors and information on how the AI Features work.
11.2 On request, the Processor will provide the Controller with materials for its records of processing activities. The Processor keeps its own records of the categories of processing activities carried out on behalf of controllers (Article 30(2) GDPR).
12. Personal Data Breach
12.1 The Processor will notify the Controller of a personal data breach concerning Controller Personal Data without undue delay after becoming aware of it, and no later than within 48 hours, by e-mail to the account administrator's address (or to the data protection contact communicated to it by the Controller) and, where possible, also by a notification in the Application.
12.2 The notification contains, to the extent the information is available: a description of the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to remedy the breach and mitigate its effects, and the Processor's contact person. Where not all information is available at the same time, the Processor will provide it in phases without further undue delay (Article 33(3) and (4) GDPR).
12.3 The Processor will without undue delay take reasonable measures to limit the consequences of the breach, document them and assist the Controller in notifying the supervisory authority and, where applicable, communicating the breach to data subjects. Notification of the supervisory authority and communication to data subjects are made by the Controller; the Processor does not make them on its behalf without its instruction, unless required to do so by a legal regulation.
12.4 Notification of a breach by the Processor does not constitute an acknowledgement of liability.
13. End of Processing, Return and Deletion of Data
13.1 After the end of the provision of the Service, the Processor will, at the Controller's choice, return (by making an export available) or delete Controller Personal Data and delete existing copies, unless EU or Member State law requires their storage (Article 28(3)(g) GDPR).
13.2 Procedure: a) after termination of the Main Agreement, the Controller has 30 days (with the possibility of extension under Article 24.2 of the Terms) to export Controller Personal Data; b) unless the Controller requests otherwise, after the expiry of the transition period the Processor will delete Controller Personal Data from production systems within 30 days and from backups in the course of their regular rotation; until overwritten, backups are protected by the measures under Annex 2 and are not actively processed; c) at the Controller's request, the Processor will confirm the deletion in writing.
13.3 Making an export available in a machine-readable format is regarded as return; data for which the Application does not offer an export will be handed over by the Processor at the Controller's request in accordance with the procedure under Article 24.1 of the Terms.
13.4 Deletion on the Controller's instruction during the term of the Main Agreement (e.g. deletion or anonymisation of a person in the Application) takes effect in production systems without undue delay and in backups in the course of their rotation.
14. Audits and Inspections
14.1 The Processor will make available to the Controller all information necessary to demonstrate compliance with the obligations under Article 28 GDPR and this DPA (Article 28(3)(h) GDPR), in particular in the form of this document, the description of technical and organisational measures, the List of Sub-processors and answers to a reasonable security questionnaire.
14.2 If the information under Article 14.1 is not sufficient, the Processor will allow the Controller, or an independent auditor mandated by the Controller who is bound by confidentiality and is not a competitor of the Processor, to carry out an audit under the following conditions: a) notice at least 30 days in advance stating the scope (does not apply in the case of a reasonable suspicion of a serious breach or on the instruction of a supervisory authority); b) no more than once every 12 months, unless the audit follows a personal data breach or is requested by a supervisory authority; c) during working hours, without disrupting the operation of the Service and without access to data of other customers or to the Processor's trade secrets; d) the costs of the audit are borne by the Controller, including the Processor's reasonable costs, unless the audit reveals a material breach of the Processor's obligations; e) audits of Sub-processors are carried out by means of their certifications and audit reports, not by on-site inspection.
14.3 The Processor will cooperate with the supervisory authority.
15. Liability
15.1 The liability of the Parties towards data subjects is governed by Article 82 GDPR.
15.2 The mutual liability of the Parties for damage resulting from a breach of this DPA is governed by Article 21 of the Terms, including its limitations, except for damage caused intentionally or through gross negligence.
15.3 The Processor is not liable for an infringement of Data Protection Legislation that consists in the content of the Controller's instructions, the configuration of the Service by the Controller or decisions under Article 5.2.
16. Contact Persons
16.1 The Processor's contact for data protection matters and security incidents is info@jobson.cloud (subject "GDPR"). The Processor has not appointed a data protection officer.
16.2 The Controller's contact is the account administrator or another data protection contact communicated by the Controller to the Processor.
17. Final Provisions
17.1 This DPA is governed by the law of the Czech Republic; disputes are resolved in accordance with Article 25 of the Terms.
17.2 In the event of a conflict between this DPA and other parts of the Main Agreement, this DPA prevails in matters of personal data protection. Where standard contractual clauses form part of this DPA, they prevail over the other provisions.
17.3 The Processor is entitled to change the DPA in accordance with the procedure under Article 27 of the Terms; changes caused by changes in legal regulations or by instructions of supervisory authorities may take effect within a shorter period.
17.4 The following form an integral part of the DPA:
- Annex 1 – Description of Processing
- Annex 2 – Technical and Organisational Measures
- Annex 3 – List of Sub-processors
Annex 1 – Description of Processing
1. Subject matter and nature of processing
Operation of the JOBSON cloud service (SaaS) for the Controller: storage, organisation, structuring, retrieval, consultation, alteration, combination, extraction of data from documents, generation of documents, calculations, sending messages on the Controller's instructions, export, archiving, anonymisation and erasure of personal data; backup; technical support; processing in AI Features (extraction and suggestions).
2. Purpose of processing
To enable the Controller to run the agenda of a staffing agency, in particular: recruitment and selection of applicants, records of persons (people records), employment relationships and temporary assignments to user undertakings, attendance records and payroll input, wage advances and cash desks, accommodation, documents and their signature, checklists and deadline monitoring, communication with applicants and employees, reports to authorities and reporting – all to the extent the Controller uses the Service.
3. Categories of data subjects
a) job applicants and candidates in the recruitment database; b) employees of the Controller, in particular temporarily assigned employees, persons working under agreements on work performed outside an employment relationship, former employees; c) family members and other persons stated by employees (e.g. dependent children for tax credits, emergency contact person); d) contact persons of the Controller's clients (user undertakings) and their sites, of business partners and of accommodation providers; e) users of the Service on the Controller's side – to the extent of data in the audit trail and task assignment; f) persons referring applicants.
4. Categories of personal data
To the extent the Controller enters them into the Service:
a) identification data: first name, surname, birth surname, date and place of birth, birth number (personal identification number), sex, nationality, where applicable a photograph; b) contact data: address of residence and stay, correspondence address, phone, e-mail (including a private e-mail address for the purposes of Section 21 of the Czech Labour Code), identifiers in communication channels; c) data from documents: type, number and validity of the identity document and travel document, residence and work permits of foreign nationals, where applicable copies of documents; d) employment data: type of employment relationship, position, workplace, user undertaking, pay grade, wages and rates, working hours, leave, obstacles to work, amendments, termination of the relationship and its reasons, qualifications, training and occupational health and safety (OHS), work evaluation; e) attendance: hours worked, shifts, allowances, absences including their type (e.g. leave, sick leave, care for a family member); f) financial and tax data: bank account number, wage advances, deductions, gross pay, taxpayer's declaration and data for tax credits, tax identifiers, data on the health insurance company and foreign insurance; g) recruitment data: CV, education, experience, language skills, driving licences, preferences, answers to questionnaires, interview records, results of the AI interview and check-in, status in the selection procedure, source of the application, consents and their validity; h) accommodation: accommodation facility, room, period of accommodation, payments, data reported to authorities; i) documents and signatures: content of contracts and other documents, image of the signature, time of signature; j) communication: content of e-mails, SMS and messages sent or received via the Service, conversations with the AI assistant and with the AI recruiter; k) technical and operational data: audit trail (who changed what and when), IP addresses and device identifiers of users, logs; l) special categories of personal data (Article 9 GDPR): in particular data concerning health (sick leave, health restrictions, medical fitness), and others where entered by the Controller; m) data relating to criminal convictions (Article 10 GDPR) – only if entered by the Controller; n) other data entered by the Controller into custom fields.
5. Duration of processing
For the term of the Main Agreement and the transition period under Article 13; individual data for the period determined by the Controller (retention periods, erasure, anonymisation). Conversations with the AI assistant are kept for 90 days.
6. Place of processing
The EEA, with the exceptions stated in Annex 3.
Annex 2 – Technical and Organisational Measures
The Processor has adopted in particular the following measures. It continuously evaluates and develops the measures (Article 7.2).
A. Confidentiality
- Separation of customer data: the data of individual customers are separated from each other directly at database level.
- User access control: roles and permissions with scope (agency, branch, client, site), creation and deactivation of users by the Controller's administrator; passwords are stored only in hashed form.
- API and MCP: access only by means of keys and tokens bound to the customer and the user, with a limited scope of permissions and limited validity; tokens can be revoked at any time.
- Access of the Processor's personnel: only authorised persons bound by confidentiality have access to production systems; they access the Controller's data only for the reasons under Article 6.2 of the DPA.
- Encryption in transit: all communication with the Application and the API is encrypted (HTTPS/TLS).
- AI processing: requests to AI models are routed through the Processor's own gateway exclusively to the EU region; only the data needed for the given AI operation are passed to the model.
- Separation of environments: development and test environments work with fictitious data, not with Controller Personal Data.
B. Integrity
- Audit trail: changes to records are recorded in the change history with identification of the actor (user, AI, integration) and time; the history is available in the Application.
- Confirmation of AI entries: AI does not write into data without confirmation by a user.
- Application security: protection by the standard security mechanisms of the application framework, input validation and ongoing remediation of identified vulnerabilities.
C. Availability and resilience
- Backup: the database of the Service is backed up regularly.
- Infrastructure: servers with a hosting provider in the EU; network firewall, protection of the server against repeated unauthorised access attempts, regular security updates.
- Monitoring: monitoring of the availability and errors of the Service (error monitoring is provided by the Sub-processor listed in Annex 3).
D. Regular testing and evaluation
- Automated tests and code checks during development.
- Internal security checks of the Service and regular evaluation of the measures.
E. Organisational measures
- Confidentiality of all persons with access to data.
- Procedure for handling security incidents, including notification to the Controller under Article 12 of the DPA.
- Selection of Sub-processors with regard to data protection safeguards and contracts under Article 28(4) GDPR.
- Granting and withdrawing personnel access as needed.
F. Data protection by design
- Tools for the Controller: retention periods, consents with purpose and expiry, anonymisation, export of data about a person, erasure.
- AI Features not requested by the user are not launched; the AI recruiter identifies itself as an artificial intelligence system.
- Conversations with the AI assistant are kept for 90 days.
Annex 3 – List of Sub-processors
Version as at the effective date of the DPA. The current list is published at https://jobson.cloud/en/dpa#subprocessors; the Processor updates it in accordance with the procedure under Article 8.
| Sub-processor | Registered office | Activity | Place of processing | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Gunzenhausen, Germany | hosting of the application and database, file and backup storage | EU | EEA – no transfer takes place |
| Google Cloud EMEA Limited (Google Cloud Vertex AI) | Dublin, Ireland | AI processing (Gemini model) – extraction of data from documents, AI assistant, AI recruiter, text suggestions, translations, transcription of recordings | EU – europe-west3 region (Frankfurt) | EEA; for any access from the Google group outside the EEA, standard contractual clauses or, where applicable, the EU–U.S. Data Privacy Framework |
| ActiveCampaign, LLC (Postmark service) | USA | sending e-mails from the Application | USA | standard contractual clauses or, where applicable, the EU–U.S. Data Privacy Framework |
| Functional Software, Inc. (Sentry service) | USA | application error monitoring (technical error logs that may incidentally contain user identifiers or IP addresses) | USA | EU–U.S. Data Privacy Framework and standard contractual clauses |
Recipients of data on the basis of the Controller's decisions (e.g. communication channels, the Controller's calendar, AI tools connected via MCP/API, public registers, authorities, banks, partner services) are not Sub-processors of the Processor.