Data Processing Agreement

1.1 Capitalised terms not defined here have the meaning given in the Agreement. “Data Protection Law” means all laws and regulations applicable to the processing of Personal Data under this DPA, including, as applicable, Regulation (EU) 2016/679 (“GDPR”), the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, and applicable United States state privacy laws including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CPRA”).

1.2 “Personal Data,” “processing,” “controller,” “processor,” “data subject,” “personal data breach,” and “special categories of personal data” have the meanings given in the GDPR.

1.3 “Customer Personal Data” means Personal Data that aplies processes on the Customer’s behalf under this DPA, as described in Annex I. “Sub-processor” means any processor engaged by aplies to process Customer Personal Data. “SCCs” means the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914. “UK Addendum” means the UK Information Commissioner’s International Data Transfer Addendum to the SCCs.

2.1 Roles. For Customer Personal Data, the Customer is the controller (or a processor acting on behalf of a third-party controller) and aplies is the processor (or sub-processor). Each party complies with its obligations under Data Protection Law in that capacity.

2.2 Scope and duration. This DPA applies to aplies’s processing of Customer Personal Data for the duration of the Agreement and until all Customer Personal Data is returned or deleted under Section 11. The subject-matter, nature, purpose, data categories, and data subjects are described in Annex I.

2.3 Customer responsibilities. The Customer warrants that it has a lawful basis and all necessary rights, consents, and notices to disclose Customer Personal Data to aplies and to instruct the processing described in this DPA, including in respect of any third-party personal data the Customer includes in a CV or application.

3.1 aplies processes Customer Personal Data only on the Customer’s documented instructions, including as set out in the Agreement, this DPA, and the Customer’s use and configuration of the Service, unless required to process by a law to which aplies is subject; in that case, aplies will inform the Customer of that legal requirement before processing, unless the law prohibits it on important grounds of public interest.

3.2 aplies will immediately inform the Customer if, in its opinion, an instruction infringes Data Protection Law. aplies will not process Customer Personal Data for its own purposes and, in particular, will not sell it or use the content of the Customer’s CV or applications to train, fine-tune, or evaluate foundation models, consistent with the Privacy Policy.

4.1 aplies ensures that persons authorised to process Customer Personal Data are bound by an appropriate obligation of confidentiality (contractual or statutory) and are subject to appropriate access limitations, and processes Customer Personal Data on a need-to-know basis.

5.1 Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risks to data subjects, aplies implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR. The measures in place as of the effective date are described in Annex II, and aplies may update them provided the level of protection is not materially reduced.

6.1 General authorisation. The Customer grants aplies general authorisation to engage Sub-processors to process Customer Personal Data. The Sub-processors engaged as of the effective date are described by category in Annex III, which cross-references aplies’s sub-processor list.

6.2 Flow-down. aplies imposes on each Sub-processor, by written contract, data-protection obligations no less protective than those in this DPA, including appropriate security measures, and remains fully liable to the Customer for the performance of each Sub-processor’s obligations.

6.3 Notice and objection. aplies will give the Customer prior notice of any intended addition or replacement of a Sub-processor. The Customer may object on reasonable, data-protection-related grounds within thirty (30) days of the notice. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service as its sole remedy, as set out in the Agreement.

7.1 Data-subject requests. Taking into account the nature of the processing, aplies assists the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling the Customer’s obligation to respond to requests from data subjects exercising their rights. If aplies receives such a request directly, it will, unless legally prohibited, promptly inform the Customer and not respond except on the Customer’s instructions.

7.2 DPIAs and prior consultation. aplies provides the Customer with reasonable assistance with data-protection impact assessments and prior consultations with supervisory authorities under Articles 35 and 36 GDPR, taking into account the information available to aplies.

7.3 Security and breach obligations. aplies assists the Customer in ensuring compliance with the obligations in Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to aplies.

8.1 aplies notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provides the Customer with information reasonably available to it to assist the Customer in meeting any obligation to notify supervisory authorities or data subjects. Such notification is not an acknowledgement of fault or liability.

9.1 Where aplies processes Customer Personal Data originating in the EEA, the UK, or Switzerland in a country that has not received an adequacy decision, the parties agree that the transfer is governed by appropriate safeguards. The SCCs (Module Two, controller-to-processor) are incorporated into and form part of this DPA by reference, and the UK Addendum applies to transfers subject to the UK GDPR. Where the Customer acts as a processor on behalf of a third-party controller, the parties will apply the module appropriate to that relationship.

9.2 SCC particulars. For the purpose of the SCCs: the Customer is the data exporter and aplies is the data importer; the optional docking clause applies; the governing law and forum are those stated in the SCCs or, where the SCCs leave the option open, those agreed by the parties in the executed DPA; and Annex I and Annex II of this DPA populate the corresponding Annexes of the SCCs. In case of conflict, the SCCs prevail over this DPA as to the transfer they govern.

10.1 aplies makes available to the Customer information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA, and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor it mandates. To protect the confidentiality and security of other customers, audits are conducted on reasonable prior notice, no more than once per twelve (12) months (unless required by a supervisory authority or following a breach), during business hours, subject to confidentiality, and aplies may satisfy an audit request in the first instance by providing its then-current security documentation and written responses to a reasonable security questionnaire. Audit and information requests should be sent to [email protected].

11.1 On termination or expiry of the Agreement, and at the Customer’s choice, aplies will delete or return all Customer Personal Data and delete existing copies, unless Data Protection Law requires storage. Deletion from active and backup systems is completed within thirty (30) days, except for data aplies is required to retain by law. This DPA continues to apply to any Customer Personal Data retained until it is deleted.

12.1 Each party’s liability arising out of or related to this DPA — whether in contract, tort, or otherwise — is subject to the exclusions and limitations of liability set out in the Terms of Service, and any reference in the Terms of Service to the liability of a party means the aggregate liability of that party under the Agreement and this DPA together. Nothing in this DPA limits any liability that cannot be limited under Data Protection Law, including, where applicable, a data subject’s rights under Article 82 GDPR.

13.1 Precedence. In case of conflict between this DPA and the Agreement on the processing of Customer Personal Data, this DPA prevails; the SCCs prevail over both as to the transfers they govern. In all other respects the Agreement remains in full force.

13.2 Changes and severability. aplies may update this DPA to reflect changes in Data Protection Law or the Service, provided the Customer’s protections are not materially reduced. If any provision is held invalid, the remainder continues in effect, and the invalid provision is modified to the minimum extent necessary to be enforceable.

13.3 Governing law. This DPA is governed by the law, and subject to the courts, stated in the Terms of Service — namely the laws of aplies’s principal place of business, with disputes heard in the courts of aplies’s principal place of business — except where Data Protection Law or the SCCs require otherwise. Formal legal notice is served in the manner set out in the Terms of Service.

A. List of parties

Data exporter (controller): the Customer — identity, address, and contact details are completed on execution of this DPA. Role: controller (or processor acting on behalf of a third-party controller). Activities relevant to the data transferred: use of the aplies Service as described in Section B. Data importer (processor): aplies, contactable for data-protection matters at [email protected]. Role: processor. Activities relevant to the data transferred: provision of the aplies Service as described in Section B. The address for service of formal legal notice on aplies is provided on written request to [email protected] (see the Terms of Service).

B. Description of the processing

Subject-matter. processing of the Customer’s CV and application data to provide the aplies Service — searching for opportunities, preparing responses, completing forms, and submitting applications the Customer directs.

Duration. for the term of the Agreement and until return or deletion under Section 11.

Nature and purpose. hosting, storage, automated preparation and submission of applications, support, and security, all on the Customer’s instructions and under its supervision.

Categories of Personal Data. identity and contact data; CV content (work history, education, skills, and any information the Customer includes); application inputs, answers, and settings; and activity and attempt logs. The CV may contain special categories of personal data (for example, data revealing health, religion, ethnicity, or trade-union membership) where the Customer chooses to include it; such data is processed only on the Customer’s instruction to deliver the Service.

Data subjects. the Customer (the applicant) and any third parties whose personal data the Customer includes in a CV or application (for example, named referees or former colleagues).

Frequency. continuous, for the duration of the Agreement, as initiated by the Customer’s use of the Service.

C. Competent supervisory authority

The competent supervisory authority is the authority determined in accordance with Articles 55–56 GDPR by reference to the Customer’s place of establishment or, where the Customer is not established in the EEA, the place where the data subjects whose personal data is transferred are located. Where the SCCs require that authority to be identified by name, it is recorded in the executed DPA.

aplies maintains the following technical and organisational measures, which it may update provided the level of protection is not materially reduced:

• Encryption — Customer Personal Data is encrypted in transit using current protocols and, where appropriate, at rest.
• Access control — role-based access on a least-privilege, need-to-know basis; unique credentials; and multi-factor authentication for administrative access.
• Least privilege — access to production data is restricted to authorised personnel and limited to what each role requires.
• Logging and monitoring — security-relevant events and access are logged and monitored to detect and investigate anomalies.
• Vendor management — Sub-processors are vetted and bound by written agreements with obligations no less protective than this DPA.
• Resilience and backups — regular backups and measures designed to restore availability and access to Personal Data in a timely manner after an incident.
• Incident response — a documented process to detect, assess, contain, and notify personal data breaches without undue delay.
• Secure development and change management — code review, environment separation, and controlled deployment practices.

aplies does not claim any third-party security certification, and nothing in this Annex should be read as asserting one. Additional or updated measures are described in aplies’s then-current security documentation, available on written request to [email protected].

The Customer authorises the Sub-processors described in aplies’s sub-processor list, which forms part of this Annex III. As of the effective date these comprise, by category: payment processing; hosting and infrastructure; AI processing (under terms that prohibit training on Customer Personal Data); and transactional email, each as further described in that list. aplies engages no analytics, advertising, or tracking sub-processors. The identity of aplies’s current sub-processors is available on written request to [email protected]. aplies gives notice of changes and provides a right to object in accordance with Section 6.

aplies is an independent product, not affiliated with or endorsed by LinkedIn. Questions about this document: [email protected]